Extracting prog: 3h45m41.735054492s Minimizing prog: 3h7m37.223723794s Simplifying prog options: 4m8.932184302s Extracting C: 39.216702249s Simplifying C: 8m34.989048566s extracting reproducer from 48 programs testing a last program of every proc single: executing 10 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-mmap-madvise-clock_gettime-clock_gettime-clock_gettime-clock_gettime-madvise-openat-write-write-write-write-write-write-write-write-write-write-write-write-write-write-write-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mknodat-nanosleep-openat-syz_usb_ep_write-close-syz_usb_disconnect detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-openat-write-close-openat-write-openat-write-close-openat-write-close-nanosleep-socket$inet_tcp-write-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) program did not crash single: failed to extract reproducer bisect: bisecting 48 programs with base timeout 30s testing program (duration=42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11, 2, 5, 5, 11, 16, 32, 20, 19, 2, 10, 11, 10, 8, 5, 1, 8, 32, 14, 28, 4, 8, 6, 7, 3, 22, 11, 10, 21, 11, 32, 21, 16, 18, 3, 1, 22, 7, 8, 3, 40, 3, 32, 2, 30, 20, 21] detailed listing: executing program 1: syz_open_dev$usbfs(&(0x7f0000000400), 0xb, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='-2 -3 +4 +4.1 +4.2\n', 0x13) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='4\n', 0x2) close(r2) executing program 1: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40402210000000000010902200001010080320904000002ff0000000705810240000007058202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x2faf080}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/devices/platform/pcspkr\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgrp\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cgrp\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgrp/cgroup.subtree_control\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='+blkio\n\x00', 0x7) close(r0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 3: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/fcloop/ctl/add_target_port\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='wwnn=0x2000000044112233,wwpn=0x1000000044112233\n', 0x32) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='fc\n', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='fc\n', 0x3) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) write(r3, &(0x7f0000000380)='nn-0x2000000044112233:pn-0x1000000044112233\n', 0x2c) close(r3) symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00') executing program 3: mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb0\x00', 0x1ff) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) executing program 32: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) executing program 33: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000100)="05000000010001", 0x7) write(r0, &(0x7f0000000200)="3000000019000100aaaaaaaaaa110142424242424242424242424242424242", 0x1f) write(r0, &(0x7f0000000300)="46000000130001000242424242424242424242424242424242", 0x19) write(r0, &(0x7f0000000400)="29000000010001", 0x7) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r1, &(0x7f0000000500)={0x1f, 0x23, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) close(r0) executing program 7: syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d61244040001000000010902270001010080320904000003ff000000070581034000010705020240000007058202400000"], 0x0) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/vendor\x00', 0x0, 0x0) read(r0, &(0x7f0000000140)=""/8, 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/device\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/8, 0x8) close(r1) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/ieee80211/phy1/netdev:wlan1/stations/08:02:11:00:00:00\x00', 0x0, 0x0) executing program 7: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/aiptek/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/128, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/devices/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r1, &(0x7f0000000700)=""/128, 0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/usb/drivers/aiptek/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r2, &(0x7f0000000900)=""/128, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/usb/devices/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r3, &(0x7f0000000b00)=""/128, 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/usb/drivers/aiptek/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r4, &(0x7f0000000d00)=""/128, 0x80) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/bus/usb/devices/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r5, &(0x7f0000000f00)=""/128, 0x80) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/bus/usb/drivers/aiptek/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r6, &(0x7f0000001100)=""/128, 0x80) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/bus/usb/devices/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r7, &(0x7f0000001300)=""/128, 0x80) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/bus/usb/drivers/aiptek/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r8, &(0x7f0000001500)=""/128, 0x80) r9 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./sys/bus/usb/devices/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r9, &(0x7f0000001700)=""/128, 0x80) r10 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./sys/bus/usb/drivers/aiptek/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r10, &(0x7f0000001900)=""/128, 0x80) r11 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./sys/bus/usb/devices/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r11, &(0x7f0000001b00)=""/128, 0x80) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000540)='-2 -3 +4\n', 0x9) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4gracetime\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/128, 0x80) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/nfsv4leasetime\x00', 0x0, 0x0) read(r1, &(0x7f0000000500)=""/128, 0x80) close(r1) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001") syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000200)="0b00020002000000010001") nanosleep(&(0x7f0000000400)={0x1}, 0x0) executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 0: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000000314050000000000000000000900020073797a30000000000800410072786500140033006574683000"/56], 0x38}}, 0x0) read(r0, &(0x7f0000000300)=""/100, 0x64) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='4\n', 0x2) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18) write(r0, &(0x7f0000000300)='delete path_grou', 0x10) close(r0) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19) write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16) write(r2, &(0x7f0000000300)='delete path_gr', 0xe) close(r2) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='path_group G4 /bin/ls\n', 0x16) write(r3, &(0x7f0000000300)='delete path_group G4 /bin/ls\n', 0x1d) close(r3) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2\n', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) close(r2) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/pci0000:00/0000:00:02.0/driver\x00', &(0x7f0000000140)=""/64, 0x40) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 2: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 6: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, &(0x7f0000a00000)) clock_gettime(0x0, &(0x7f0000a01000)) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc) write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc) write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc) write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb) write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9) write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r0, &(0x7f0000000640), 0x0) write(r0, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd) executing program 6: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 10 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-mmap-madvise-clock_gettime-clock_gettime-clock_gettime-clock_gettime-madvise-openat-write-write-write-write-write-write-write-write-write-write-write-write-write-write-write-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mknodat-nanosleep-openat-syz_usb_ep_write-close-syz_usb_disconnect detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-openat-write-close-openat-write-openat-write-close-openat-write-close-nanosleep-socket$inet_tcp-write-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r2) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) program did not crash single: failed to extract reproducer bisect: bisecting 48 programs with base timeout 1m40s testing program (duration=1m52s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11, 2, 5, 5, 11, 16, 32, 20, 19, 2, 10, 11, 10, 8, 5, 1, 8, 32, 14, 28, 4, 8, 6, 7, 3, 22, 11, 10, 21, 11, 32, 21, 16, 18, 3, 1, 22, 7, 8, 3, 40, 3, 32, 2, 30, 20, 21] detailed listing: executing program 1: syz_open_dev$usbfs(&(0x7f0000000400), 0xb, 0x2) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='-2 -3 +4 +4.1 +4.2\n', 0x13) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='4\n', 0x2) close(r2) executing program 1: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b40402210000000000010902200001010080320904000002ff0000000705810240000007058202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x2faf080}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/devices/platform/pcspkr\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgrp\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cgrp\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgrp/cgroup.subtree_control\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='+blkio\n\x00', 0x7) close(r0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 3: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/fcloop/ctl/add_target_port\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='wwnn=0x2000000044112233,wwpn=0x1000000044112233\n', 0x32) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='fc\n', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='fc\n', 0x3) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) write(r3, &(0x7f0000000380)='nn-0x2000000044112233:pn-0x1000000044112233\n', 0x2c) close(r3) symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00') executing program 3: mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb0\x00', 0x1ff) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) executing program 32: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze\n', 0x7) close(r2) executing program 33: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='freezer', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='freeze', 0x6) executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000100)="05000000010001", 0x7) write(r0, &(0x7f0000000200)="3000000019000100aaaaaaaaaa110142424242424242424242424242424242", 0x1f) write(r0, &(0x7f0000000300)="46000000130001000242424242424242424242424242424242", 0x19) write(r0, &(0x7f0000000400)="29000000010001", 0x7) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r1, &(0x7f0000000500)={0x1f, 0x23, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) close(r0) executing program 7: syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d61244040001000000010902270001010080320904000003ff000000070581034000010705020240000007058202400000"], 0x0) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/vendor\x00', 0x0, 0x0) read(r0, &(0x7f0000000140)=""/8, 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/device\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/8, 0x8) close(r1) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/ieee80211/phy1/netdev:wlan1/stations/08:02:11:00:00:00\x00', 0x0, 0x0) executing program 7: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/aiptek/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/128, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/devices/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r1, &(0x7f0000000700)=""/128, 0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/usb/drivers/aiptek/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r2, &(0x7f0000000900)=""/128, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/usb/devices/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r3, &(0x7f0000000b00)=""/128, 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/usb/drivers/aiptek/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r4, &(0x7f0000000d00)=""/128, 0x80) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/bus/usb/devices/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r5, &(0x7f0000000f00)=""/128, 0x80) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/bus/usb/drivers/aiptek/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r6, &(0x7f0000001100)=""/128, 0x80) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/bus/usb/devices/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r7, &(0x7f0000001300)=""/128, 0x80) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/bus/usb/drivers/aiptek/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r8, &(0x7f0000001500)=""/128, 0x80) r9 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./sys/bus/usb/devices/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r9, &(0x7f0000001700)=""/128, 0x80) r10 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./sys/bus/usb/drivers/aiptek/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r10, &(0x7f0000001900)=""/128, 0x80) r11 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./sys/bus/usb/devices/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r11, &(0x7f0000001b00)=""/128, 0x80) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000540)='-2 -3 +4\n', 0x9) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4gracetime\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/128, 0x80) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/nfsv4leasetime\x00', 0x0, 0x0) read(r1, &(0x7f0000000500)=""/128, 0x80) close(r1) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001") syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000200)="0b00020002000000010001") nanosleep(&(0x7f0000000400)={0x1}, 0x0) executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 0: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000000314050000000000000000000900020073797a30000000000800410072786500140033006574683000"/56], 0x38}}, 0x0) read(r0, &(0x7f0000000300)=""/100, 0x64) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='4\n', 0x2) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18) write(r0, &(0x7f0000000300)='delete path_grou', 0x10) close(r0) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19) write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16) write(r2, &(0x7f0000000300)='delete path_gr', 0xe) close(r2) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='path_group G4 /bin/ls\n', 0x16) write(r3, &(0x7f0000000300)='delete path_group G4 /bin/ls\n', 0x1d) close(r3) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2\n', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) close(r2) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/pci0000:00/0000:00:02.0/driver\x00', &(0x7f0000000140)=""/64, 0x40) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 2: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 6: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, &(0x7f0000a00000)) clock_gettime(0x0, &(0x7f0000a01000)) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc) write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc) write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc) write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb) write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9) write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r0, &(0x7f0000000640), 0x0) write(r0, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd) executing program 6: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: bisecting 48 programs bisect: split chunks (needed=false): <48> bisect: split chunk #0 of len 48 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 8, 32, 14, 28, 4, 8, 6, 7, 3, 22, 11, 10, 21, 11, 32, 21, 16, 18, 3, 1, 22, 7, 8, 3, 40, 3, 32, 2, 30, 20, 21] detailed listing: executing program 7: syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d61244040001000000010902270001010080320904000003ff000000070581034000010705020240000007058202400000"], 0x0) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/vendor\x00', 0x0, 0x0) read(r0, &(0x7f0000000140)=""/8, 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/device\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/8, 0x8) close(r1) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/ieee80211/phy1/netdev:wlan1/stations/08:02:11:00:00:00\x00', 0x0, 0x0) executing program 7: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/aiptek/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/128, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/devices/1-1:17.0/ytilt\x00', 0x0, 0x0) read(r1, &(0x7f0000000700)=""/128, 0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/usb/drivers/aiptek/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r2, &(0x7f0000000900)=""/128, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/usb/devices/1-1:1.0/ytilt\x00', 0x0, 0x0) read(r3, &(0x7f0000000b00)=""/128, 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/usb/drivers/aiptek/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r4, &(0x7f0000000d00)=""/128, 0x80) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/bus/usb/devices/2-1:17.0/ytilt\x00', 0x0, 0x0) read(r5, &(0x7f0000000f00)=""/128, 0x80) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/bus/usb/drivers/aiptek/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r6, &(0x7f0000001100)=""/128, 0x80) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/bus/usb/devices/2-1:1.0/ytilt\x00', 0x0, 0x0) read(r7, &(0x7f0000001300)=""/128, 0x80) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/bus/usb/drivers/aiptek/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r8, &(0x7f0000001500)=""/128, 0x80) r9 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./sys/bus/usb/devices/3-1:17.0/ytilt\x00', 0x0, 0x0) read(r9, &(0x7f0000001700)=""/128, 0x80) r10 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./sys/bus/usb/drivers/aiptek/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r10, &(0x7f0000001900)=""/128, 0x80) r11 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./sys/bus/usb/devices/3-1:1.0/ytilt\x00', 0x0, 0x0) read(r11, &(0x7f0000001b00)=""/128, 0x80) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000540)='-2 -3 +4\n', 0x9) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4gracetime\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/128, 0x80) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/nfsv4leasetime\x00', 0x0, 0x0) read(r1, &(0x7f0000000500)=""/128, 0x80) close(r1) executing program 4: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001") syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000200)="0b00020002000000010001") nanosleep(&(0x7f0000000400)={0x1}, 0x0) executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 0: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000000314050000000000000000000900020073797a30000000000800410072786500140033006574683000"/56], 0x38}}, 0x0) read(r0, &(0x7f0000000300)=""/100, 0x64) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='4\n', 0x2) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18) write(r0, &(0x7f0000000300)='delete path_grou', 0x10) close(r0) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19) write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16) write(r2, &(0x7f0000000300)='delete path_gr', 0xe) close(r2) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='path_group G4 /bin/ls\n', 0x16) write(r3, &(0x7f0000000300)='delete path_group G4 /bin/ls\n', 0x1d) close(r3) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2\n', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) close(r2) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1', 0x9) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/pci0000:00/0000:00:02.0/driver\x00', &(0x7f0000000140)=""/64, 0x40) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 2: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 6: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, &(0x7f0000a00000)) clock_gettime(0x0, &(0x7f0000a01000)) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc) write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc) write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc) write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb) write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9) write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r0, &(0x7f0000000640), 0x0) write(r0, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd) executing program 6: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program crashed: WARNING in __set_task_frozen bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 18, 3, 1, 22, 7, 8, 3, 40, 3, 32, 2, 30, 20, 21] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/pci0000:00/0000:00:02.0/driver\x00', &(0x7f0000000140)=""/64, 0x40) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 2: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 6: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, &(0x7f0000a00000)) clock_gettime(0x0, &(0x7f0000a01000)) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc) write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc) write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc) write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb) write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9) write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r0, &(0x7f0000000640), 0x0) write(r0, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd) executing program 6: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <16> bisect: split chunk #0 of len 16 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 40, 3, 32, 2, 30, 20, 21] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/pci0000:00/0000:00:02.0/driver\x00', &(0x7f0000000140)=""/64, 0x40) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x30, 0x0, &(0x7f0000001000), 0x40, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000600)='a', 0x1, 0x0, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) executing program 2: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='7\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/enabled\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='always\n', 0x7) mmap(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, 0x0) clock_gettime(0x0, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='+ 1 0 1 1', 0x9) write(r2, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r2, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r2, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r2, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r2, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r2, &(0x7f0000000440), 0x0) write(r2, &(0x7f0000000480)='+ 0 0 2 1 0', 0xb) write(r2, &(0x7f00000004c0)='+ 0 0 3 1 0', 0xb) write(r2, &(0x7f0000000500)='+ 0 0 4 1 0\n', 0xc) write(r2, &(0x7f0000000580)='+ 1 0 1 60 0\n', 0xd) write(r2, &(0x7f00000005c0)='+ 1 0 2 60 0\n', 0xd) write(r2, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r2, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd) write(r2, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) executing program 6: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe) clock_gettime(0x0, &(0x7f0000800000)) clock_gettime(0x0, &(0x7f0000801000)) clock_gettime(0x0, &(0x7f0000a00000)) clock_gettime(0x0, &(0x7f0000a01000)) madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc) write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc) write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc) write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc) write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc) write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc) write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc) write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc) write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb) write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc) write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9) write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd) write(r0, &(0x7f0000000640), 0x0) write(r0, &(0x7f0000000680)='+ 1 0 5 60 0\n', 0xd) write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd) executing program 6: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='rdma\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f00000004c0)='4420\n', 0x5) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='ipv4\n', 0x5) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 18, 3, 1, 22, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 22, 7, 8] detailed listing: executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 18, 3] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) program did not crash bisect: split chunks (needed=true): <4>, <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 3, 1, 22, 7, 8] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65', 0xc) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0) executing program 4: mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/nvmet/subsystems/test\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/subsystems/test\x00', 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 1, 22, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: the chunk can be dropped bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 1, 22] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) program did not crash bisect: split chunks (needed=true): <2>, <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 1, 22, 7, 8] detailed listing: executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 1, 22, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 22, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='localhost / 2147483647 0x1a403 0 0 0', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) write(r5, &(0x7f0000000580)="80000078123456780000000000000002000186a30000000400000001000000010000002000000000000000096c6f63616c686f73740000000000000000000000000000000000000000000000000000000000000000000002000000180000001a0000000000000000000000000000000000001000", 0x74) read(r5, &(0x7f0000000600)=""/256, 0x100) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 1, 7, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: the chunk can be dropped bisect: split chunk #2 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 1, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 16, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <1>, <1>, <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #2 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #3 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 4 programs left: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) bisect: trying to concatenate bisect: concatenate 4 entries minimizing program #0 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r4, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r4, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r4, 0x400c0930, 0x0) write(r4, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='md0\n', 0x4) ioctl(0xffffffffffffffff, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(0xffffffffffffffff, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(0xffffffffffffffff, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(0xffffffffffffffff, 0x400c0930, 0x0) write(0xffffffffffffffff, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r3, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r3, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r3, 0x400c0930, 0x0) write(r3, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r3, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r3, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r3, 0x400c0930, 0x0) write(r3, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) write(0xffffffffffffffff, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000240)='100\n', 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 16, 1, 7] detailed listing: executing program 0: mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) close(r3) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash minimized 21 calls -> 18 calls minimizing program #1 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 15, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 15, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) close(r1) ioctl(0xffffffffffffffff, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(0xffffffffffffffff) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r1, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r1) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) ioctl$MEMERASE(0xffffffffffffffff, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r1, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r1) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(0xffffffffffffffff) r0 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r0, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r1, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r1) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13, 1, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 0: mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash minimized 16 calls -> 14 calls minimizing program #2 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 0, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 0: executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash minimized 1 calls -> 1 calls minimizing program #3 before concatenation testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 14, 1, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r0) r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) executing program 6: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 0: write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash minimized 7 calls -> 7 calls testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work bisect: concatenation succeeded found reproducer with 40 syscalls minimizing guilty program testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-syz_usb_connect-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-close-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-nanosleep-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-close-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) close(r5) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-ioctl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl(r5, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r6, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r5, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) r4 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) ioctl$MEMERASE(r4, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r5, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r5, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r5, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(0xffffffffffffffff) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mount-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mkdirat-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-write-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-ioctl-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) ioctl(0xffffffffffffffff, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(0xffffffffffffffff, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(0xffffffffffffffff, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(0xffffffffffffffff, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r2) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r2) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) write(0xffffffffffffffff, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r2) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r2) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000240)='100\n', 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r1, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r2) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000240)='100\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='md0\n', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)) ioctl(r2, 0x40140921, &(0x7f0000000600)="0000000001000000000000000000000006000000") ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, 0x0) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)) write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000700)='/dev/ram0,65536', 0xf) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(0x0, 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, 0x0, 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, 0x0, 0x0) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program did not crash simplifying guilty program options testing program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work extracting C reproducer testing compiled C program (duration=1m42.611008584s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work simplifying C reproducer testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing compiled C program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep program crashed: KASAN: slab-use-after-free Read in atkbd_event_work testing program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work validation run: crashed=true testing program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work validation run: crashed=true testing program (duration=1m42.611008584s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-openat-ioctl-ioctl-ioctl-write-mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-openat$ubi_ctrl-nanosleep-close-syz_usb_connect-openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dbg/fail_make_request/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dbg/fail_make_request/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1000\n', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/ram1/make-it-fail\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000500)="000000000000000000000000000000000a00000000080000020000000200000000000000010000000000000001000000020000000200000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000640)="0100000001000000010000000100000006000000") write(r2, &(0x7f0000000700)='\x00'/3958, 0xf76) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) nanosleep(0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program crashed: KASAN: slab-use-after-free Read in atkbd_event_work validation run: crashed=true reproducing took 7h12m29.621328174s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in atkbd_event_work+0x592/0x650 drivers/input/keyboard/atkbd.c:-1 Read of size 4 at addr ffff888034ee2164 by task kworker/0:3/5675 CPU: 0 UID: 0 PID: 5675 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: events atkbd_event_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 atkbd_event_work+0x592/0x650 drivers/input/keyboard/atkbd.c:-1 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 187: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] input_allocate_device+0x4e/0x2a0 drivers/input/input.c:1960 atkbd_connect+0xb1/0x9c0 drivers/input/keyboard/atkbd.c:1258 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x82/0xa0 drivers/input/serio/serio.c:748 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 serio_add_port drivers/input/serio/serio.c:512 [inline] serio_handle_event+0x9e6/0xf80 drivers/input/serio/serio.c:197 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5857: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kfree+0x1c5/0x650 mm/slub.c:6801 input_dev_release+0xab/0xc0 drivers/input/input.c:1644 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 atkbd_disconnect+0xb5/0x110 drivers/input/keyboard/atkbd.c:966 serio_disconnect_driver drivers/input/serio/serio.c:62 [inline] serio_driver_remove+0x85/0xa0 drivers/input/serio/serio.c:755 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 serio_disconnect_port drivers/input/serio/serio.c:646 [inline] serio_unregister_port+0x128/0x150 drivers/input/serio/serio.c:679 userio_char_release+0x80/0xc0 drivers/input/serio/userio.c:105 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888034ee2000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 356 bytes inside of freed 4096-byte region [ffff888034ee2000, ffff888034ee3000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34ee0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4990, tgid 4990 (udevd), ts 30044158671 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x47b/0x720 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x229/0x470 security/tomoyo/file.c:776 security_file_open+0xa9/0x240 security/security.c:2739 do_dentry_open+0x4a0/0x1380 fs/open.c:973 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 page last free pid 4977 tgid 4977 ts 30037884153 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 __slab_free+0x274/0x2c0 mm/slub.c:5823 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_node_noprof+0x354/0x610 mm/slub.c:5068 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704 netlink_sendmsg+0x5d4/0xb40 net/netlink/af_netlink.c:1875 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2713 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767 __sys_sendmsg net/socket.c:2799 [inline] __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888034ee2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888034ee2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888034ee2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888034ee2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888034ee2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in atkbd_event_work+0x592/0x650 drivers/input/keyboard/atkbd.c:-1 Read of size 4 at addr ffff888034ee2164 by task kworker/0:3/5675 CPU: 0 UID: 0 PID: 5675 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: events atkbd_event_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 atkbd_event_work+0x592/0x650 drivers/input/keyboard/atkbd.c:-1 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 187: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] input_allocate_device+0x4e/0x2a0 drivers/input/input.c:1960 atkbd_connect+0xb1/0x9c0 drivers/input/keyboard/atkbd.c:1258 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x82/0xa0 drivers/input/serio/serio.c:748 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 serio_add_port drivers/input/serio/serio.c:512 [inline] serio_handle_event+0x9e6/0xf80 drivers/input/serio/serio.c:197 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5857: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kfree+0x1c5/0x650 mm/slub.c:6801 input_dev_release+0xab/0xc0 drivers/input/input.c:1644 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 atkbd_disconnect+0xb5/0x110 drivers/input/keyboard/atkbd.c:966 serio_disconnect_driver drivers/input/serio/serio.c:62 [inline] serio_driver_remove+0x85/0xa0 drivers/input/serio/serio.c:755 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 serio_disconnect_port drivers/input/serio/serio.c:646 [inline] serio_unregister_port+0x128/0x150 drivers/input/serio/serio.c:679 userio_char_release+0x80/0xc0 drivers/input/serio/userio.c:105 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888034ee2000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 356 bytes inside of freed 4096-byte region [ffff888034ee2000, ffff888034ee3000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34ee0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4990, tgid 4990 (udevd), ts 30044158671 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x47b/0x720 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x229/0x470 security/tomoyo/file.c:776 security_file_open+0xa9/0x240 security/security.c:2739 do_dentry_open+0x4a0/0x1380 fs/open.c:973 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 page last free pid 4977 tgid 4977 ts 30037884153 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 __slab_free+0x274/0x2c0 mm/slub.c:5823 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_node_noprof+0x354/0x610 mm/slub.c:5068 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704 netlink_sendmsg+0x5d4/0xb40 net/netlink/af_netlink.c:1875 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2713 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767 __sys_sendmsg net/socket.c:2799 [inline] __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888034ee2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888034ee2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888034ee2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888034ee2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888034ee2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================