Extracting prog: 1h46m36.031931651s
Minimizing prog: 7m21.579713189s
Simplifying prog options: 0s
Extracting C: 1m49.667481044s
Simplifying C: 13m4.684140345s


extracting reproducer from 26 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac1-nanosleep-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE-nanosleep-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE-nanosleep-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE
detailed listing:
executing program 0:
syz_usb_connect$uac1(0x2, 0xb2, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa0, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x100, 0x2a}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x201, 0x0, 0x1}, @feature_unit={0xb, 0x24, 0x6, 0x2, 0x1, 0x2, [0x1, 0x1]}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x301, 0x0, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x1, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x3, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x82, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x3}, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nfc
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-nanosleep-openat-openat-ioctl-ioctl-ioctl-ioctl-ioctl
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write-write-write-write-write-write-write-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)

program did not crash
single: failed to extract reproducer
bisect: bisecting 26 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 4, 9, 6, 12, 6, 15, 2, 13, 11, 4, 9, 4, 6, 23, 2, 13, 20, 5, 13, 10, 4]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
syz_usb_connect(0x0, 0x97, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04203000010000000109028500020100803209040000000101000009240100013f0001010c24020101020001000000000c24020201020001000000000c24020301020001000000000924050e03010203000924030f0101000e000904010000010200000904010101010200000724010f0101000b2402010102100180bb0009058105640001000007250101000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000400))
executing program 0:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='+2 +3 -4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n\x00', 0x2)
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000500)="0000000000000000000000000000000001000000000000000000000001000000000000000100"/72)
ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000007000000000000000000000003000000")
ioctl(r1, 0x400c0930, &(0x7f0000000700)='\x00'/12)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/serialize_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='linear\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='4\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='4096\x00', 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r4, 0x0, 0x0)
write(r4, &(0x7f0000000380)='1:1\x00', 0x4)
write(r4, &(0x7f00000003c0), 0x0)
write(r4, &(0x7f0000000400)='1:3\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000480)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r5, &(0x7f0000000500)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/dev-ram2/slot\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/block/md0/md/dev-ram3/slot\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='3\x00', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r7, &(0x7f0000000680)='acti', 0x4)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x10, &(0x7f0000000200)=@raw=[@generic={0x79, 0x6, 0x1, 0x70}, @generic={0xbf, 0x1, 0xa}, @generic={0x7, 0x1, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x2, 0x0, 0x0, 0x8}, @generic={0xbf, 0x3, 0x6}, @generic={0x7, 0x3, 0x0, 0x0, 0xffffffe8}, @generic={0x85, 0x0, 0x0, 0x0, 0x4}, @generic={0x62, 0xa, 0x0, 0xfffc}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffffc}, @generic={0xbf, 0x3, 0xa}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}, @generic={0x95}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1b6)
fallocate(r0, 0x0, 0x0, 0x10000)
pwrite64(r0, &(0x7f0000000100)="fc4e2ba9010000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000a000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c532ba90100"/257, 0x101, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x0, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='md123\x00', 0x6)
write(0xffffffffffffffff, &(0x7f0000000500)='1.1\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000700)='7:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md123/md/array_state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000900)='active\x00', 0x7)
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a1018510150026ff00750895068100910085119513810091008512953f81009100c0"}}, 0x13f)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff0100"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x7, "10ff001102005a"}}, 0xd)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/nullb/nullb1/memory_backed\x00', 0x2, 0x0)
write(r1, &(0x7f0000000e00)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000a00)=@filename='./dev/nullb1\x00', &(0x7f0000001100)='./mnt\x00', &(0x7f0000001200)='zonefs\x00', 0x0, 0x0)
executing program 4:
syz_usb_connect$uac1(0x2, 0xb2, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa0, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x100, 0x2a}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x201, 0x0, 0x1}, @feature_unit={0xb, 0x24, 0x6, 0x2, 0x1, 0x2, [0x1, 0x1]}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x301, 0x0, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x1, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x3, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x82, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x3}, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in input_dev_uevent
bisect: bisecting 26 programs
bisect: split chunks (needed=false): <26>
bisect: split chunk #0 of len 26 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15, 2, 13, 11, 4, 9, 4, 6, 23, 2, 13, 20, 5, 13, 10, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='linear\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='4\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='4096\x00', 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r4, 0x0, 0x0)
write(r4, &(0x7f0000000380)='1:1\x00', 0x4)
write(r4, &(0x7f00000003c0), 0x0)
write(r4, &(0x7f0000000400)='1:3\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000480)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r5, &(0x7f0000000500)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/dev-ram2/slot\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/block/md0/md/dev-ram3/slot\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='3\x00', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r7, &(0x7f0000000680)='acti', 0x4)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x10, &(0x7f0000000200)=@raw=[@generic={0x79, 0x6, 0x1, 0x70}, @generic={0xbf, 0x1, 0xa}, @generic={0x7, 0x1, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x2, 0x0, 0x0, 0x8}, @generic={0xbf, 0x3, 0x6}, @generic={0x7, 0x3, 0x0, 0x0, 0xffffffe8}, @generic={0x85, 0x0, 0x0, 0x0, 0x4}, @generic={0x62, 0xa, 0x0, 0xfffc}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffffc}, @generic={0xbf, 0x3, 0xa}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}, @generic={0x95}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1b6)
fallocate(r0, 0x0, 0x0, 0x10000)
pwrite64(r0, &(0x7f0000000100)="fc4e2ba9010000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000a000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c532ba90100"/257, 0x101, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x0, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='md123\x00', 0x6)
write(0xffffffffffffffff, &(0x7f0000000500)='1.1\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000700)='7:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md123/md/array_state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000900)='active\x00', 0x7)
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a1018510150026ff00750895068100910085119513810091008512953f81009100c0"}}, 0x13f)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff0100"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x7, "10ff001102005a"}}, 0xd)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/nullb/nullb1/memory_backed\x00', 0x2, 0x0)
write(r1, &(0x7f0000000e00)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000a00)=@filename='./dev/nullb1\x00', &(0x7f0000001100)='./mnt\x00', &(0x7f0000001200)='zonefs\x00', 0x0, 0x0)
executing program 4:
syz_usb_connect$uac1(0x2, 0xb2, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa0, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x100, 0x2a}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x201, 0x0, 0x1}, @feature_unit={0xb, 0x24, 0x6, 0x2, 0x1, 0x2, [0x1, 0x1]}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x301, 0x0, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x1, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x3, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x82, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x3}, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 4, 9, 6, 12, 23, 2, 13, 20, 5, 13, 10, 4]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
syz_usb_connect(0x0, 0x97, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04203000010000000109028500020100803209040000000101000009240100013f0001010c24020101020001000000000c24020201020001000000000c24020301020001000000000924050e03010203000924030f0101000e000904010000010200000904010101010200000724010f0101000b2402010102100180bb0009058105640001000007250101000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000400))
executing program 0:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='+2 +3 -4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n\x00', 0x2)
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000500)="0000000000000000000000000000000001000000000000000000000001000000000000000100"/72)
ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000007000000000000000000000003000000")
ioctl(r1, 0x400c0930, &(0x7f0000000700)='\x00'/12)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/serialize_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='linear\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='4\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='4096\x00', 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r4, 0x0, 0x0)
write(r4, &(0x7f0000000380)='1:1\x00', 0x4)
write(r4, &(0x7f00000003c0), 0x0)
write(r4, &(0x7f0000000400)='1:3\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000480)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r5, &(0x7f0000000500)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/dev-ram2/slot\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/block/md0/md/dev-ram3/slot\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='3\x00', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r7, &(0x7f0000000680)='acti', 0x4)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x10, &(0x7f0000000200)=@raw=[@generic={0x79, 0x6, 0x1, 0x70}, @generic={0xbf, 0x1, 0xa}, @generic={0x7, 0x1, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x2, 0x0, 0x0, 0x8}, @generic={0xbf, 0x3, 0x6}, @generic={0x7, 0x3, 0x0, 0x0, 0xffffffe8}, @generic={0x85, 0x0, 0x0, 0x0, 0x4}, @generic={0x62, 0xa, 0x0, 0xfffc}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffffc}, @generic={0xbf, 0x3, 0xa}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}, @generic={0x95}], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1b6)
fallocate(r0, 0x0, 0x0, 0x10000)
pwrite64(r0, &(0x7f0000000100)="fc4e2ba9010000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000a000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c532ba90100"/257, 0x101, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x0, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='md123\x00', 0x6)
write(0xffffffffffffffff, &(0x7f0000000500)='1.1\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000700)='7:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md123/md/array_state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000900)='active\x00', 0x7)
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a1018510150026ff00750895068100910085119513810091008512953f81009100c0"}}, 0x13f)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff0100"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x7, "10ff001102005a"}}, 0xd)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a)
read(r0, &(0x7f0000001000), 0x1000)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/nullb/nullb1/memory_backed\x00', 0x2, 0x0)
write(r1, &(0x7f0000000e00)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000a00)=@filename='./dev/nullb1\x00', &(0x7f0000001100)='./mnt\x00', &(0x7f0000001200)='zonefs\x00', 0x0, 0x0)
executing program 4:
syz_usb_connect$uac1(0x2, 0xb2, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa0, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x100, 0x2a}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x201, 0x0, 0x1}, @feature_unit={0xb, 0x24, 0x6, 0x2, 0x1, 0x2, [0x1, 0x1]}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x301, 0x0, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x1, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x3, 0x8, 0x5}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x200, 0xfff}]}, {{0x9, 0x5, 0x82, 0x5, 0x200, 0x1, 0x0, 0x0, {0x7, 0x25, 0x1, 0x1}}}}}}}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
nanosleep(&(0x7f0000000300)={0x3}, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000200)={{0x1, 0x2}, 0x0, [0x1, 0x1, 0x1, 0x1]})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 4, 9, 6, 12, 6, 15, 2, 13, 11, 4, 9, 4, 6]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
syz_usb_connect(0x0, 0x97, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04203000010000000109028500020100803209040000000101000009240100013f0001010c24020101020001000000000c24020201020001000000000c24020301020001000000000924050e03010203000924030f0101000e000904010000010200000904010101010200000724010f0101000b2402010102100180bb0009058105640001000007250101000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000400))
executing program 0:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='+2 +3 -4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n\x00', 0x2)
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000500)="0000000000000000000000000000000001000000000000000000000001000000000000000100"/72)
ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000007000000000000000000000003000000")
ioctl(r1, 0x400c0930, &(0x7f0000000700)='\x00'/12)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/serialize_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)

program crashed: general protection fault in hidpp_raw_hidpp_event
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <9>, <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9, 6, 12, 6, 15, 2, 13, 11, 4, 9, 4, 6]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x97, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04203000010000000109028500020100803209040000000101000009240100013f0001010c24020101020001000000000c24020201020001000000000c24020301020001000000000924050e03010203000924030f0101000e000904010000010200000904010101010200000724010f0101000b2402010102100180bb0009058105640001000007250101000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000400))
executing program 0:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='+2 +3 -4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n\x00', 0x2)
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000500)="0000000000000000000000000000000001000000000000000000000001000000000000000100"/72)
ioctl(r1, 0x40140921, &(0x7f0000000600)="0000000007000000000000000000000003000000")
ioctl(r1, 0x400c0930, &(0x7f0000000700)='\x00'/12)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/serialize_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 6, 15, 2, 13, 11, 4, 9, 4, 6]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
bisect: the chunk can be dropped
bisect: split chunk #1 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 4, 9, 4, 6]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000100)='deflate\x00', 0x8)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff)
mount$overlay(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './lower'}}, {@upperdir={'upperdir', 0x3d, './upper'}}, {@workdir={'workdir', 0x3d, './work'}}, {@index_on}, {@nfs_export_on}]})
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', 0x41, 0x1ff)
name_to_handle_at(0xffffffffffffff9c, &(0x7f00000001c0)='./merge/file\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="8000"/136], &(0x7f0000000300), 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000200)=ANY=[], 0x0)
executing program 2:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 4, 31, 6, 15, 2, 13, 11]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 31, 6, 15, 2, 13, 11]
detailed listing:
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 6, 15, 2, 13, 11]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
bisect: the chunk can be dropped
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 13, 11]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 8, 30, 6, 15, 2]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff0007058402000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)={0x84, &(0x7f0000003000)={0xc0, 0x0, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001100)={0x84, &(0x7f0000003100)={0xc0, 0x2, 0x1, "14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
syz_usb_control_io(r0, &(0x7f0000002000), &(0x7f0000001200))
nanosleep(&(0x7f0000004000)={0x1}, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000004100), 0x0, 0x2)
executing program 0:
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)

program did not crash
bisect: split chunks (needed=true): <3>, <3>, <2>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 6, 15, 2, 13, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/flowlabel_consistency\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='0\x00', 0x2)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@empty, 0x0, 0x0, 0x0, 0x4}, 0x20)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/fs/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0: 127.0.0.1\n', 0x14)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 2, 13, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 2, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 3 programs left: 

executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)


bisect: trying to concatenate
bisect: concatenate 3 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='disk', 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in sur40_open
minimized 30 calls -> 2 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 1, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 0:
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x2, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 0:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)
ioctl(r1, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
minimized 2 calls -> 0 calls
minimizing program #2 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 10]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r1, 0xc058560f, &(0x7f0000000700)="0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/84)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 9]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r1, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 7]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 6]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 5]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)

program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 3]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 2]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 2]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 0, 1]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
executing program 2:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

program crashed: KASAN: use-after-free Read in sur40_open
minimized 11 calls -> 1 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mkdirat-syz_usb_connect
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mkdirat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_usb_connect
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in input_dev_uevent
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/input/touchscreen/sur40.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in sur40_open
validation run: crashed=true
reproducing took 2h13m11.810963662s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in sur40_command drivers/input/touchscreen/sur40.c:258 [inline]
BUG: KASAN: use-after-free in sur40_init drivers/input/touchscreen/sur40.c:352 [inline]
BUG: KASAN: use-after-free in sur40_open+0x9d/0x440 drivers/input/touchscreen/sur40.c:397
Read of size 8 at addr ffff88807f3c0000 by task acpid/3624

CPU: 1 PID: 3624 Comm: acpid Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 sur40_command drivers/input/touchscreen/sur40.c:258 [inline]
 sur40_init drivers/input/touchscreen/sur40.c:352 [inline]
 sur40_open+0x9d/0x440 drivers/input/touchscreen/sur40.c:397
 input_open_device+0x16d/0x2e0 drivers/input/input.c:650
 evdev_open_device drivers/input/evdev.c:400 [inline]
 evdev_open+0x4a6/0x5a0 drivers/input/evdev.c:487
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7dd/0x10b0 fs/open.c:882
 do_open fs/namei.c:3634 [inline]
 path_openat+0x2674/0x2f10 fs/namei.c:3791
 do_filp_open+0x1ee/0x420 fs/namei.c:3818
 do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f4c2592b407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff965c6d40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f4c258a1740 RCX: 00007f4c2592b407
RDX: 0000000000080800 RSI: 00007fff965c6f50 RDI: ffffffffffffff9c
RBP: 00007fff965c6f50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000020
R13: 00007fff965c7050 R14: 000055beab2217fe R15: 00007fff965c7050
 </TASK>

Allocated by task 4364:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 sur40_probe+0x164/0xf10 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4364:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 sur40_probe+0x8a2/0xf10 drivers/input/touchscreen/sur40.c:816
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff88807f3c0000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes inside of
 4096-byte region [ffff88807f3c0000, ffff88807f3c1000)

The buggy address belongs to the physical page:
page:ffffea0001fcf000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f3c0
head:ffffea0001fcf000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888017442140
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4364, tgid 4364 (kworker/0:11), ts 107237152806, free_ts 107002084631
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 sur40_probe+0x164/0xf10 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
 free_slab mm/slub.c:2036 [inline]
 discard_slab mm/slub.c:2042 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2591
 put_cpu_partial+0x17c/0x250 mm/slub.c:2667
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3383
 getname_flags+0xb7/0x500 fs/namei.c:139
 do_sys_openat2+0xdd/0x4f0 fs/open.c:1314
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff88807f3bff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807f3bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807f3c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88807f3c0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807f3c0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in sur40_command drivers/input/touchscreen/sur40.c:258 [inline]
BUG: KASAN: use-after-free in sur40_init drivers/input/touchscreen/sur40.c:352 [inline]
BUG: KASAN: use-after-free in sur40_open+0x9d/0x440 drivers/input/touchscreen/sur40.c:397
Read of size 8 at addr ffff88807f3c0000 by task acpid/3624

CPU: 1 PID: 3624 Comm: acpid Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 sur40_command drivers/input/touchscreen/sur40.c:258 [inline]
 sur40_init drivers/input/touchscreen/sur40.c:352 [inline]
 sur40_open+0x9d/0x440 drivers/input/touchscreen/sur40.c:397
 input_open_device+0x16d/0x2e0 drivers/input/input.c:650
 evdev_open_device drivers/input/evdev.c:400 [inline]
 evdev_open+0x4a6/0x5a0 drivers/input/evdev.c:487
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7dd/0x10b0 fs/open.c:882
 do_open fs/namei.c:3634 [inline]
 path_openat+0x2674/0x2f10 fs/namei.c:3791
 do_filp_open+0x1ee/0x420 fs/namei.c:3818
 do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f4c2592b407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff965c6d40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f4c258a1740 RCX: 00007f4c2592b407
RDX: 0000000000080800 RSI: 00007fff965c6f50 RDI: ffffffffffffff9c
RBP: 00007fff965c6f50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000020
R13: 00007fff965c7050 R14: 000055beab2217fe R15: 00007fff965c7050
 </TASK>

Allocated by task 4364:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 sur40_probe+0x164/0xf10 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 4364:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 sur40_probe+0x8a2/0xf10 drivers/input/touchscreen/sur40.c:816
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff88807f3c0000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes inside of
 4096-byte region [ffff88807f3c0000, ffff88807f3c1000)

The buggy address belongs to the physical page:
page:ffffea0001fcf000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f3c0
head:ffffea0001fcf000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888017442140
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4364, tgid 4364 (kworker/0:11), ts 107237152806, free_ts 107002084631
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 sur40_probe+0x164/0xf10 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
 free_slab mm/slub.c:2036 [inline]
 discard_slab mm/slub.c:2042 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2591
 put_cpu_partial+0x17c/0x250 mm/slub.c:2667
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3383
 getname_flags+0xb7/0x500 fs/namei.c:139
 do_sys_openat2+0xdd/0x4f0 fs/open.c:1314
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff88807f3bff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807f3bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807f3c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88807f3c0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807f3c0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================