Extracting prog: 47m52.348056615s
Minimizing prog: 26m34.431983906s
Simplifying prog options: 0s
Extracting C: 1m55.766505429s
Simplifying C: 36m6.688608872s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-write-write-openat-write-write-write-write-write-write-write-write-write-openat-write-openat-write-openat-write-openat-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$COMEDI_CMD
detailed listing:
executing program 0:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-ioctl$BLKPG-ioctl$BLKPG
detailed listing:
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11, 8, 2, 4, 4, 8, 3, 22, 26, 2, 17, 4, 22, 5, 4, 2, 4, 26, 3, 23, 26, 4, 13, 5, 3, 3, 2, 33]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/nfsd/cld\x00', 0x0, 0x0)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/pcspkr\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00'})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='+bond1\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond1/bonding/mode\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='balance-rr\n', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bond1/bonding/arp_interval\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='10\n', 0x3)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='all\n', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/class/net/bond1/bonding/arp_ip_target\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='+192.0.2.1\n', 0xb)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='+dummy0\n', 0x8)
nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0)
executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10)
executing program 4:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[], 0x0)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)='\x00'/64)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
syz_open_dev$dvb_dvr(&(0x7f0000000500), 0x0, 0x2)
r1 = syz_open_dev$dvb_demux(&(0x7f0000000600), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040))
write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16)
ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000")
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040cb0404010001000000010902200001010080320904000002000000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r1 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r2 = syz_open_dev$video(&(0x7f0000000100), 0x2, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r3 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r4 = syz_open_dev$video(&(0x7f0000000100), 0x4, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r5 = syz_open_dev$video(&(0x7f0000000100), 0x5, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r6 = syz_open_dev$video(&(0x7f0000000100), 0x6, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r7 = syz_open_dev$video(&(0x7f0000000100), 0x7, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r8 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r9 = syz_open_dev$video(&(0x7f0000000100), 0x9, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r9, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/gve\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200)=""/4096, 0x1000)
openat(r0, &(0x7f0000000263), 0x1, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/dma\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000000010000000000005c63f225d9b7536f3e5f97349bf3f11ba313538598a84d63bb456904392b9b77504280e5d58667456b18a1dad449e5c2dca6db703a1cdc08287bb8a93bec9ce8b6a2344315d039f2be2752925fae01bedbcbe04859ba10dbc80d4aa4f992cbb8d78ac34cc30e8532fbb8bac26b7fd3ec79b2ae974963e21211ef0f8939256fc151c494941b8fdfaaf79b47530077ce9cbf9b76407575092f8600e01d71abe944a2047794dc9df748076fb674c76bdec21828452e4ec2cc8036009fd2ed06c8dccb083249c7e3bf01000000000000000d70c568790f16d588ad1fbf10ca31d7436a2fe39aabfb694e20f273fffb2bc8d27fd14155abb5821148d8571a65899dfe0ae9723f02a02a42895b95393f6adead23351ac7f51e1341fa161a1ac9a91207358c56fcce4b371a4d6ac261c5ed862e1987a15758ecbe6a955a2f2c5adcf9c8e2a47c489610512be3ca913d03face73b86897bc48769d90dcefdf871369c5c61dc5b5a76ce80e2fb2ce7ae18a66ede83d81db4b", @ANYRESDEC=0x0, @ANYBLOB="09e200"/18, @ANYBLOB='\x00'/10], 0x48)
close(0x3)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x68, 0x14, 0xf0b, 0x3, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xffe0, 0xe}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x4, 0x400a, 0x2, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x4, 0xc, 0x1, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040)
r2 = socket$kcm(0xa, 0x2, 0x0)
syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0)
r3 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000280)=']', 0x1}], 0x1}, 0x20004040)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6"], &(0x7f0000000140)='GPL\x00'}, 0x94)
r5 = socket$kcm(0x2, 0x1, 0x0)
sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4})
r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0)
syz_usb_control_io$hid(r6, 0x0, 0x0)
syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="ac184d", @ANYRESHEX=r1, @ANYRES8=r0, @ANYRESDEC=r2, @ANYRES8=r5], 0x0, 0x0, 0x0, 0x0})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/pch_udc\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/rnullb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/memory_backed\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zoned\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
close(r1)
write(0xffffffffffffffff, &(0x7f0000000180)='4\n', 0x2)
close(0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_capacity\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='4\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_nr_conv\x00', 0x1, 0x0)
write(r3, &(0x7f0000000180)='1\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='64\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/power\x00', 0x1, 0x0)
write(r5, &(0x7f0000000180)='1\n', 0x2)
close(r5)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr\x00', &(0x7f0000000200)=""/1024, 0x400)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/serial8250\x00', &(0x7f0000000400)=""/1024, 0x400)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}}, 0x0)
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})
executing program 1:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})
executing program 3:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-write-write-openat-write-write-write-write-write-write-write-write-write-openat-write-openat-write-openat-write-openat-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$COMEDI_CMD
detailed listing:
executing program 0:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-ioctl$BLKPG-ioctl$BLKPG
detailed listing:
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11, 8, 2, 4, 4, 8, 3, 22, 26, 2, 17, 4, 22, 5, 4, 2, 4, 26, 3, 23, 26, 4, 13, 5, 3, 3, 2, 33]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/nfsd/cld\x00', 0x0, 0x0)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/pcspkr\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00'})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='+bond1\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond1/bonding/mode\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='balance-rr\n', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bond1/bonding/arp_interval\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='10\n', 0x3)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='all\n', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/class/net/bond1/bonding/arp_ip_target\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='+192.0.2.1\n', 0xb)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='+dummy0\n', 0x8)
nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0)
executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10)
executing program 4:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[], 0x0)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)='\x00'/64)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
syz_open_dev$dvb_dvr(&(0x7f0000000500), 0x0, 0x2)
r1 = syz_open_dev$dvb_demux(&(0x7f0000000600), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040))
write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16)
ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000")
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040cb0404010001000000010902200001010080320904000002000000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r1 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r2 = syz_open_dev$video(&(0x7f0000000100), 0x2, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r3 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r4 = syz_open_dev$video(&(0x7f0000000100), 0x4, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r5 = syz_open_dev$video(&(0x7f0000000100), 0x5, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r6 = syz_open_dev$video(&(0x7f0000000100), 0x6, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r7 = syz_open_dev$video(&(0x7f0000000100), 0x7, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r8 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r9 = syz_open_dev$video(&(0x7f0000000100), 0x9, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r9, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/gve\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200)=""/4096, 0x1000)
openat(r0, &(0x7f0000000263), 0x1, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/dma\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000000010000000000005c63f225d9b7536f3e5f97349bf3f11ba313538598a84d63bb456904392b9b77504280e5d58667456b18a1dad449e5c2dca6db703a1cdc08287bb8a93bec9ce8b6a2344315d039f2be2752925fae01bedbcbe04859ba10dbc80d4aa4f992cbb8d78ac34cc30e8532fbb8bac26b7fd3ec79b2ae974963e21211ef0f8939256fc151c494941b8fdfaaf79b47530077ce9cbf9b76407575092f8600e01d71abe944a2047794dc9df748076fb674c76bdec21828452e4ec2cc8036009fd2ed06c8dccb083249c7e3bf01000000000000000d70c568790f16d588ad1fbf10ca31d7436a2fe39aabfb694e20f273fffb2bc8d27fd14155abb5821148d8571a65899dfe0ae9723f02a02a42895b95393f6adead23351ac7f51e1341fa161a1ac9a91207358c56fcce4b371a4d6ac261c5ed862e1987a15758ecbe6a955a2f2c5adcf9c8e2a47c489610512be3ca913d03face73b86897bc48769d90dcefdf871369c5c61dc5b5a76ce80e2fb2ce7ae18a66ede83d81db4b", @ANYRESDEC=0x0, @ANYBLOB="09e200"/18, @ANYBLOB='\x00'/10], 0x48)
close(0x3)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x68, 0x14, 0xf0b, 0x3, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xffe0, 0xe}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x4, 0x400a, 0x2, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x4, 0xc, 0x1, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040)
r2 = socket$kcm(0xa, 0x2, 0x0)
syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0)
r3 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000280)=']', 0x1}], 0x1}, 0x20004040)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6"], &(0x7f0000000140)='GPL\x00'}, 0x94)
r5 = socket$kcm(0x2, 0x1, 0x0)
sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4})
r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0)
syz_usb_control_io$hid(r6, 0x0, 0x0)
syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="ac184d", @ANYRESHEX=r1, @ANYRES8=r0, @ANYRESDEC=r2, @ANYRES8=r5], 0x0, 0x0, 0x0, 0x0})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/pch_udc\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/rnullb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/memory_backed\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zoned\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
close(r1)
write(0xffffffffffffffff, &(0x7f0000000180)='4\n', 0x2)
close(0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_capacity\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='4\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_nr_conv\x00', 0x1, 0x0)
write(r3, &(0x7f0000000180)='1\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='64\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/power\x00', 0x1, 0x0)
write(r5, &(0x7f0000000180)='1\n', 0x2)
close(r5)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr\x00', &(0x7f0000000200)=""/1024, 0x400)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/serial8250\x00', &(0x7f0000000400)=""/1024, 0x400)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}}, 0x0)
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})
executing program 1:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})
executing program 3:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 2, 17, 4, 22, 5, 4, 2, 4, 26, 3, 23, 26, 4, 13, 5, 3, 3, 2, 33]
detailed listing:
executing program 4:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10)
executing program 4:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[], 0x0)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)='\x00'/64)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
read(0xffffffffffffffff, &(0x7f0000000300)=""/4096, 0x1000)
ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000400)=0x1)
syz_open_dev$dvb_dvr(&(0x7f0000000500), 0x0, 0x2)
r1 = syz_open_dev$dvb_demux(&(0x7f0000000600), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29)
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040))
write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16)
ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000")
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040cb0404010001000000010902200001010080320904000002000000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000400)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r1 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r2 = syz_open_dev$video(&(0x7f0000000100), 0x2, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r3 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r4 = syz_open_dev$video(&(0x7f0000000100), 0x4, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r5 = syz_open_dev$video(&(0x7f0000000100), 0x5, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r6 = syz_open_dev$video(&(0x7f0000000100), 0x6, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r7 = syz_open_dev$video(&(0x7f0000000100), 0x7, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r8 = syz_open_dev$video(&(0x7f0000000100), 0x8, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
r9 = syz_open_dev$video(&(0x7f0000000100), 0x9, 0x2)
ioctl$VIDIOC_ENUM_FRAMESIZES(r9, 0xc02c564a, &(0x7f0000000200)={0x1, 0x4745504a, 0x1})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/gve\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200)=""/4096, 0x1000)
openat(r0, &(0x7f0000000263), 0x1, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/dma\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000000010000000000005c63f225d9b7536f3e5f97349bf3f11ba313538598a84d63bb456904392b9b77504280e5d58667456b18a1dad449e5c2dca6db703a1cdc08287bb8a93bec9ce8b6a2344315d039f2be2752925fae01bedbcbe04859ba10dbc80d4aa4f992cbb8d78ac34cc30e8532fbb8bac26b7fd3ec79b2ae974963e21211ef0f8939256fc151c494941b8fdfaaf79b47530077ce9cbf9b76407575092f8600e01d71abe944a2047794dc9df748076fb674c76bdec21828452e4ec2cc8036009fd2ed06c8dccb083249c7e3bf01000000000000000d70c568790f16d588ad1fbf10ca31d7436a2fe39aabfb694e20f273fffb2bc8d27fd14155abb5821148d8571a65899dfe0ae9723f02a02a42895b95393f6adead23351ac7f51e1341fa161a1ac9a91207358c56fcce4b371a4d6ac261c5ed862e1987a15758ecbe6a955a2f2c5adcf9c8e2a47c489610512be3ca913d03face73b86897bc48769d90dcefdf871369c5c61dc5b5a76ce80e2fb2ce7ae18a66ede83d81db4b", @ANYRESDEC=0x0, @ANYBLOB="09e200"/18, @ANYBLOB='\x00'/10], 0x48)
close(0x3)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x68, 0x14, 0xf0b, 0x3, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xffe0, 0xe}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x4, 0x400a, 0x2, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x4, 0xc, 0x1, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040)
r2 = socket$kcm(0xa, 0x2, 0x0)
syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0)
r3 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000280)=']', 0x1}], 0x1}, 0x20004040)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6"], &(0x7f0000000140)='GPL\x00'}, 0x94)
r5 = socket$kcm(0x2, 0x1, 0x0)
sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4})
r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0)
syz_usb_control_io$hid(r6, 0x0, 0x0)
syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="ac184d", @ANYRESHEX=r1, @ANYRES8=r0, @ANYRESDEC=r2, @ANYRES8=r5], 0x0, 0x0, 0x0, 0x0})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/pch_udc\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/rnullb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/memory_backed\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zoned\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
close(r1)
write(0xffffffffffffffff, &(0x7f0000000180)='4\n', 0x2)
close(0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_capacity\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='4\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_nr_conv\x00', 0x1, 0x0)
write(r3, &(0x7f0000000180)='1\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='64\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/power\x00', 0x1, 0x0)
write(r5, &(0x7f0000000180)='1\n', 0x2)
close(r5)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr\x00', &(0x7f0000000200)=""/1024, 0x400)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/serial8250\x00', &(0x7f0000000400)=""/1024, 0x400)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}}, 0x0)
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})
executing program 1:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})
executing program 3:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11, 8, 2, 4, 4, 8, 3, 22, 3, 23, 26, 4, 13, 5, 3, 3, 2, 33]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/nfsd/cld\x00', 0x0, 0x0)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/pcspkr\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00'})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='+bond1\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond1/bonding/mode\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='balance-rr\n', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bond1/bonding/arp_interval\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='10\n', 0x3)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='all\n', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/class/net/bond1/bonding/arp_ip_target\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='+192.0.2.1\n', 0xb)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='+dummy0\n', 0x8)
nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/pch_udc\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/rnullb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/memory_backed\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zoned\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
close(r1)
write(0xffffffffffffffff, &(0x7f0000000180)='4\n', 0x2)
close(0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_capacity\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='4\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_nr_conv\x00', 0x1, 0x0)
write(r3, &(0x7f0000000180)='1\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='64\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/power\x00', 0x1, 0x0)
write(r5, &(0x7f0000000180)='1\n', 0x2)
close(r5)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr\x00', &(0x7f0000000200)=""/1024, 0x400)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/serial8250\x00', &(0x7f0000000400)=""/1024, 0x400)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xe, 0x0, 0x10, 0x4, 0xc0, 0x1}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0\n\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='devices\n\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='freeze\n\x00', 0x7)
close(r2)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}}, 0x0)
executing program 0:
r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2)
ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x10000, 0x1}})
ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x2, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x1}})
executing program 1:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x4, 0x2710, 0x8, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})
executing program 3:
syz_usb_connect(0x0, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/dynamic_debug/control\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='file resource.c +p\n', 0x13)
write(r0, &(0x7f0000000200)='module pnp +p\n', 0xe)
write(r0, &(0x7f0000000240)='module pnpacpi +p\n', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='00:00\n', 0x6)
write(r1, &(0x7f0000000300)='00:01\n', 0x6)
write(r1, &(0x7f0000000340)='00:02\n', 0x6)
write(r1, &(0x7f0000000380)='00:03\n', 0x6)
write(r1, &(0x7f00000003c0)='00:04\n', 0x6)
write(r1, &(0x7f0000000400)='00:05\n', 0x6)
write(r1, &(0x7f0000000440)='00:06\n', 0x6)
write(r1, &(0x7f0000000480)='00:07\n', 0x6)
write(r1, &(0x7f00000004c0)='00:08\n', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/bus/pnp/devices/00:01/resources\x00', 0x1, 0x0)
write(r2, &(0x7f00000005c0)='get\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pnp/devices/00:02/resources\x00', 0x1, 0x0)
write(r3, &(0x7f0000000640)='get\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pnp/devices/00:03/resources\x00', 0x1, 0x0)
write(r4, &(0x7f00000006c0)='get\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pnp/devices/00:04/resources\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/bus/pnp/devices/00:05/resources\x00', 0x1, 0x0)
write(r5, &(0x7f00000007c0)='get\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/devices/00:06/resources\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='get\n', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/pnp/devices/00:07/resources\x00', 0x1, 0x0)
write(r7, &(0x7f00000008c0)='get\n', 0x4)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pnp/devices/00:08/resources\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='get\n', 0x4)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11, 8, 2, 4, 4, 8, 3, 22]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/nfsd/cld\x00', 0x0, 0x0)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/pcspkr\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00'})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='+bond1\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond1/bonding/mode\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='balance-rr\n', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bond1/bonding/arp_interval\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='10\n', 0x3)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='all\n', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/class/net/bond1/bonding/arp_ip_target\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='+192.0.2.1\n', 0xb)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='+dummy0\n', 0x8)
nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 8, 3, 22]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/nfsd/cld\x00', 0x0, 0x0)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/pcspkr\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'dummy0\x00'})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='+bond1\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond1/bonding/mode\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='balance-rr\n', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bond1/bonding/arp_interval\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='10\n', 0x3)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='all\n', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/class/net/bond1/bonding/arp_ip_target\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='+192.0.2.1\n', 0xb)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='+dummy0\n', 0x8)
nanosleep(&(0x7f0000000500)={0x0, 0x11e1a300}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11, 8, 2]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 2]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='2\n', 0x2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond1/bonding/arp_validate\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='all\n', 0x4)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 11]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/self/maps\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/1000, 0x3e8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/thunderbolt/devices\x00', 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write-nanosleep
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write-nanosleep
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
bisect: concatenation succeeded
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, 0x0, 0x0)

program did not crash
testing program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m19.336607986s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
simplifying C reproducer
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing compiled C program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in rc_dev_uevent
testing program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
validation run: crashed=true
testing program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
validation run: crashed=true
testing program (duration=1m19.336607986s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)

program crashed: KASAN: use-after-free Read in rc_dev_uevent
validation run: crashed=true
reproducing took 1h59m11.517764959s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:643 [inline]
BUG: KASAN: use-after-free in string+0x204/0x290 lib/vsprintf.c:725
Read of size 1 at addr ffff888026584728 by task udevd/3638

CPU: 0 PID: 3638 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 string_nocheck lib/vsprintf.c:643 [inline]
 string+0x204/0x290 lib/vsprintf.c:725
 vsnprintf+0x10db/0x1c20 lib/vsprintf.c:2805
 add_uevent_var+0x1cd/0x460 lib/kobject_uevent.c:680
 rc_dev_uevent+0x15b/0x190 drivers/media/rc/rc-main.c:1631
 dev_uevent+0x4d6/0x740 drivers/base/core.c:2622
 uevent_show+0x1a8/0x320 drivers/base/core.c:2671
 dev_attr_show+0x50/0xb0 drivers/base/core.c:2372
 sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59
 seq_read_iter+0x460/0xc50 fs/seq_file.c:230
 call_read_iter include/linux/fs.h:2265 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x471/0x960 fs/read_write.c:470
 ksys_read+0x14d/0x260 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa1058a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcbd009900 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fa105f5e880 RCX: 00007fa1058a7407
RDX: 0000000000001000 RSI: 000055718f290f10 RDI: 000000000000000c
RBP: 00007fa1059efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fa1059efea0 R14: 0000000000000000 R15: 000055718f2615e0
 </TASK>

Allocated by task 4430:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 redrat3_dev_probe+0x3ef/0x23c0 drivers/media/rc/redrat3.c:1025
 usb_probe_interface+0x6e7/0xcf0 drivers/usb/core/driver.c:395
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2664
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5904
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4430:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 redrat3_delete drivers/media/rc/redrat3.c:466 [inline]
 redrat3_dev_probe+0x1b69/0x23c0 drivers/media/rc/redrat3.c:1126
 usb_probe_interface+0x6e7/0xcf0 drivers/usb/core/driver.c:395
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2664
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5904
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff888026584000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1832 bytes inside of
 2048-byte region [ffff888026584000, ffff888026584800)

The buggy address belongs to the physical page:
page:ffffea0000996000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26580
head:ffffea0000996000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017442000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9, tgid 9 (kworker/u4:0), ts 7102523467, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc+0xa3/0x240 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 scsi_alloc_target+0x135/0xbd0 drivers/scsi/scsi_scan.c:501
 __scsi_scan_target+0x152/0x1050 drivers/scsi/scsi_scan.c:1698
 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline]
 scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832
 do_scsi_scan_host drivers/scsi/scsi_scan.c:1971 [inline]
 do_scan_async+0x10e/0x750 drivers/scsi/scsi_scan.c:1981
 async_run_entry_fn+0x93/0x3e0 kernel/async.c:127
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888026584600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026584680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888026584700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff888026584780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026584800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:643 [inline]
BUG: KASAN: use-after-free in string+0x204/0x290 lib/vsprintf.c:725
Read of size 1 at addr ffff888026584728 by task udevd/3638

CPU: 0 PID: 3638 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 string_nocheck lib/vsprintf.c:643 [inline]
 string+0x204/0x290 lib/vsprintf.c:725
 vsnprintf+0x10db/0x1c20 lib/vsprintf.c:2805
 add_uevent_var+0x1cd/0x460 lib/kobject_uevent.c:680
 rc_dev_uevent+0x15b/0x190 drivers/media/rc/rc-main.c:1631
 dev_uevent+0x4d6/0x740 drivers/base/core.c:2622
 uevent_show+0x1a8/0x320 drivers/base/core.c:2671
 dev_attr_show+0x50/0xb0 drivers/base/core.c:2372
 sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59
 seq_read_iter+0x460/0xc50 fs/seq_file.c:230
 call_read_iter include/linux/fs.h:2265 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x471/0x960 fs/read_write.c:470
 ksys_read+0x14d/0x260 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa1058a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcbd009900 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fa105f5e880 RCX: 00007fa1058a7407
RDX: 0000000000001000 RSI: 000055718f290f10 RDI: 000000000000000c
RBP: 00007fa1059efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fa1059efea0 R14: 0000000000000000 R15: 000055718f2615e0
 </TASK>

Allocated by task 4430:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 redrat3_dev_probe+0x3ef/0x23c0 drivers/media/rc/redrat3.c:1025
 usb_probe_interface+0x6e7/0xcf0 drivers/usb/core/driver.c:395
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2664
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5904
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4430:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 redrat3_delete drivers/media/rc/redrat3.c:466 [inline]
 redrat3_dev_probe+0x1b69/0x23c0 drivers/media/rc/redrat3.c:1126
 usb_probe_interface+0x6e7/0xcf0 drivers/usb/core/driver.c:395
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2664
 hub_port_connect drivers/usb/core/hub.c:5522 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5662 [inline]
 port_event drivers/usb/core/hub.c:5822 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5904
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff888026584000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1832 bytes inside of
 2048-byte region [ffff888026584000, ffff888026584800)

The buggy address belongs to the physical page:
page:ffffea0000996000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26580
head:ffffea0000996000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017442000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9, tgid 9 (kworker/u4:0), ts 7102523467, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc+0xa3/0x240 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 scsi_alloc_target+0x135/0xbd0 drivers/scsi/scsi_scan.c:501
 __scsi_scan_target+0x152/0x1050 drivers/scsi/scsi_scan.c:1698
 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline]
 scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832
 do_scsi_scan_host drivers/scsi/scsi_scan.c:1971 [inline]
 do_scan_async+0x10e/0x750 drivers/scsi/scsi_scan.c:1981
 async_run_entry_fn+0x93/0x3e0 kernel/async.c:127
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888026584600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026584680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888026584700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff888026584780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026584800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================