Extracting prog: 1h21m19.763856105s
Minimizing prog: 10m29.851380922s
Simplifying prog options: 0s
Extracting C: 1m12.824420872s
Simplifying C: 11m12.899348865s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1-nanosleep-openat-write-close-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-sendmsg$nl_xfrm-socket$inet-openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-madvise-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-openat$sw_sync-ioctl$SW_SYNC_IOC_CREATE_FENCE-pipe-ioctl$SYNC_IOC_MERGE-listen-accept4-setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='freeze\n', 0x7)
close(r2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 8, 20, 9, 5, 11, 10, 10, 4, 8, 10, 9, 5, 7, 28, 2, 3, 8, 17, 10, 5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0/driver\x00', &(0x7f0000000200), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0/driver\x00', &(0x7f0000000400), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000600), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/devices/0000:00:04.0/driver\x00', &(0x7f0000000800), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pci/devices/0000:00:05.0/driver\x00', &(0x7f0000000a00), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/pci/devices/0000:00:1f.0/driver\x00', &(0x7f0000000c00), 0x100)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/hid/drivers/hid-logitech\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./sys/bus/hid/drivers/logitech\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/hid/drivers/hid-generic\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/hid/drivers/generic\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/hid/drivers/hid-lg\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/hid/drivers/lg\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/hid/drivers/logitech-djreceiver\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/hid/drivers/logitech-hidpp\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/hid/drivers/lg4ff\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/hid/drivers/hid-lg4ff\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/drivers/hid-corsair\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/hid/drivers/corsair\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/hid/drivers/hid-asus\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/hid/drivers/asus\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/hid/drivers/hid-lenovo\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/hid/drivers/lenovo\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/hid/drivers/hid-roccat\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/hid/drivers/roccat\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000300)="0400"/800, 0x320, 0xfffffffffffffffd)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000600)='ecryptfs\x00', 0x0, &(0x7f0000000700)='ecryptfs_sig=1000100010001000,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
setxattr(&(0x7f0000000800)='./mnt\x00', &(0x7f0000000900)=@known='user.syz\x00', &(0x7f0000000a00)='val\x00', 0x3, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='freeze\n', 0x7)
close(r2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:03.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:04.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:05.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/devices/0000:00:1f.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:1f.2\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'syzkaller0\x00', 0x1})
unshare(0x40000000)
r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00')
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'syzkaller0\x00'}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x3c}}, 0x0)
close(r1)
close(r2)
unshare(0x40000000)
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf0800}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd2\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd2\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300)=""/100, 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 3:
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f00000005c0)='ipv4\n', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r2, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r3, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1-nanosleep-openat-write-close-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-sendmsg$nl_xfrm-socket$inet-openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-madvise-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-openat$sw_sync-ioctl$SW_SYNC_IOC_CREATE_FENCE-pipe-ioctl$SYNC_IOC_MERGE-listen-accept4-setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='freeze\n', 0x7)
close(r2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 8, 20, 9, 5, 11, 10, 10, 4, 8, 10, 9, 5, 7, 28, 2, 3, 8, 17, 10, 5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0/driver\x00', &(0x7f0000000200), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0/driver\x00', &(0x7f0000000400), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000600), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/devices/0000:00:04.0/driver\x00', &(0x7f0000000800), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pci/devices/0000:00:05.0/driver\x00', &(0x7f0000000a00), 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/pci/devices/0000:00:1f.0/driver\x00', &(0x7f0000000c00), 0x100)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/hid/drivers/hid-logitech\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./sys/bus/hid/drivers/logitech\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/hid/drivers/hid-generic\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/hid/drivers/generic\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/hid/drivers/hid-lg\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/hid/drivers/lg\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/hid/drivers/logitech-djreceiver\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/hid/drivers/logitech-hidpp\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/hid/drivers/lg4ff\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/hid/drivers/hid-lg4ff\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/drivers/hid-corsair\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/hid/drivers/corsair\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/hid/drivers/hid-asus\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/hid/drivers/asus\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/hid/drivers/hid-lenovo\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/hid/drivers/lenovo\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/hid/drivers/hid-roccat\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/hid/drivers/roccat\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000300)="0400"/800, 0x320, 0xfffffffffffffffd)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000600)='ecryptfs\x00', 0x0, &(0x7f0000000700)='ecryptfs_sig=1000100010001000,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
setxattr(&(0x7f0000000800)='./mnt\x00', &(0x7f0000000900)=@known='user.syz\x00', &(0x7f0000000a00)='val\x00', 0x3, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='0\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='freeze\n', 0x7)
close(r2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:03.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:04.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:05.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/devices/0000:00:1f.0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:1f.2\x00', 0x0, 0x0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'syzkaller0\x00', 0x1})
unshare(0x40000000)
r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00')
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'syzkaller0\x00'}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x3c}}, 0x0)
close(r1)
close(r2)
unshare(0x40000000)
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf0800}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd2\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd2\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300)=""/100, 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 3:
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f00000005c0)='ipv4\n', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r2, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r3, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 7, 28, 2, 3, 8, 17, 10, 5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd2\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd2\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300)=""/100, 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 3:
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f00000005c0)='ipv4\n', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r2, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r3, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 7, 28, 2, 3, 8, 17, 10]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd2\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd2\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300)=""/100, 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 3:
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f00000005c0)='ipv4\n', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r2, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r3, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)

program did not crash
bisect: split chunks (needed=true): <10>, <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3, 8, 17, 10, 5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd2\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd2\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300)=""/100, 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='1\x00', 0x1)
pipe2(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write(r1, &(0x7f0000000240)='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', 0x38)
read(r0, &(0x7f0000800000)=""/64, 0x40)
madvise(&(0x7f0000000000/0x900000)=nil, 0x900000, 0x15)
executing program 3:
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f00000005c0)='ipv4\n', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r2, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r3, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 7, 28, 5, 2, 12, 5, 1, 4, 11, 28, 5, 11]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: split chunk #1 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 7, 28, 4, 11, 28, 5, 11]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/hpet_acpi\x00', 0x0, 0x0)
close(r0)
executing program 4:
r0 = syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
syz_usb_ep_write(r0, 0x83, 0x1, &(0x7f0000000100))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000120))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000140))
syz_usb_ep_write(r0, 0x83, 0x2, &(0x7f0000000160))
syz_usb_ep_write(r0, 0x83, 0x4, &(0x7f0000000180))
nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000500)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0x4000000, 0xf, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='1\n\x00', 0x2)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]})
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/pm_test\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='devices\n', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='freeze\n', 0x7)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 7, 28, 5, 2, 12, 5, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 28, 5, 2, 12, 5, 1]
detailed listing:
executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r2, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="2200071900050000000018d90b84362cb51df662dbec5dcd22256294a2379e0d7b7db0cc888069a7c381b332e4e394bfc56dbf01a8f1f00229542fff9d666f4101aed9bbdd1f7b509b1e1e6a25ecd0a09b4caa33ba04a4637997f4faa22f524756823ca45036815b20189ba9"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, 0x0, 0x0}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000190001002bbd70000000000000000000000000000000000000000001fe80000000000000000000000000000f00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000003c00000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001010000e75abe8826ad088b093053f7d4488400ac111c00511343b2d9a0ced47bcd15d053acec54259911c80bde5b22618d4d2508ec4896378139e4a746bc8587f1b1ab7ca1516c7eb3"], 0xb8}}, 0x0)
r1 = socket$inet(0xa, 0x801, 0x84)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000})
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x3, "1f938a7b853b3a0a00000000000000000000fc00", <r5=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r6=>0xffffffffffffffff})
ioctl$SYNC_IOC_MERGE(r5, 0xc0303e03, &(0x7f0000000140)={"50edd24983fde74e78682dbc67d293c19050af5f39c0ce29436807917da2c17e", r6})
listen(r1, 0x8)
r7 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x73, 0x983a}, 0x88)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 5, 2, 12, 5, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
executing program 1:
syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900001000000010902320001010080320904000002ff0000000705020200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='/dev/ram0,65536\n\x00', 0x11)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000180), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000200)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000280)="000000000100"/24)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ubi/ubi0/dev\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 5, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>, <2>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='- - -\n', 0x6)
close(r0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 4:
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 9, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16)
write(r0, &(0x7f0000000380)='NULL\n\x00', 0x5)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>, <1>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunks (needed=true): <1>, <1, final>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000700)={0x0, 0x989680}, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='0\n\x00', 0x2)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='lapic\n\x00', 0x6)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/clockevents/clockevent1/unbind_device\x00', 0x1, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='lapic\n\x00', 0x6)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/clockevents/clockevent0/unbind_device\x00', 0x1, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5]
detailed listing:
executing program 0:
executing program 3:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0})

program crashed: KASAN: use-after-free Read in v4l2_open
minimized 9 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4]
detailed listing:
executing program 2:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1})

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3]
detailed listing:
executing program 2:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)
syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2)

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2]
detailed listing:
executing program 2:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)
nanosleep(&(0x7f0000000080)={0x1}, 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 1]
detailed listing:
executing program 2:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0]
detailed listing:
executing program 2:
executing program 0:

program crashed: lost connection to test machine
ignore low priority crash: lost connection to test machine
minimized 5 calls -> 1 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
bisect: concatenation succeeded
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, 0x0, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
simplifying C reproducer
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in em28xx_release_resources
a never seen crash title: KASAN: use-after-free Read in em28xx_release_resources, ignore
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: use-after-free Read in v4l2_open
testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
validation run: crashed=true
testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
validation run: crashed=true
testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0)

program crashed: KASAN: use-after-free Read in v4l2_open
validation run: crashed=true
reproducing took 1h49m16.295552715s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in v4l2_open+0x32d/0x340 drivers/media/v4l2-core/v4l2-dev.c:432
Read of size 4 at addr ffff88805bbe49b0 by task v4l_id/4408

CPU: 0 PID: 4408 Comm: v4l_id Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 v4l2_open+0x32d/0x340 drivers/media/v4l2-core/v4l2-dev.c:432
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7f8e662407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fffdb8562f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f7f8e574880 RCX: 00007f7f8e662407
RDX: 0000000000000000 RSI: 00007fffdb857f1e RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007fffdb856540 R14: 00007f7f8edf0000 R15: 000055c92ee5c4d8
 </TASK>

The buggy address belongs to the page:
page:ffffea00016ef900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bbe4
head:ffffea00016ef900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO), pid 4289, ts 89835392322, free_ts 89698080619
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 kmalloc_order+0x40/0x150 mm/slab_common.c:986
 kmalloc_order_trace+0x14/0xf0 mm/slab_common.c:1002
 kmalloc_large include/linux/slab.h:536 [inline]
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:738 [inline]
 em28xx_v4l2_init+0xd5/0x2cd0 drivers/media/usb/em28xx/em28xx-video.c:2550
 em28xx_init_extension+0x118/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1126
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 free_nonslab_page+0xde/0x150 mm/slub.c:3540
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2130 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x155a/0x2cd0 drivers/media/usb/em28xx/em28xx-video.c:2919
 em28xx_init_extension+0x118/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1126
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Memory state around the buggy address:
 ffff88805bbe4880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88805bbe4900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88805bbe4980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                     ^
 ffff88805bbe4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88805bbe4a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in v4l2_open+0x32d/0x340 drivers/media/v4l2-core/v4l2-dev.c:432
Read of size 4 at addr ffff88805bbe49b0 by task v4l_id/4408

CPU: 0 PID: 4408 Comm: v4l_id Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 v4l2_open+0x32d/0x340 drivers/media/v4l2-core/v4l2-dev.c:432
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7f8e662407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fffdb8562f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f7f8e574880 RCX: 00007f7f8e662407
RDX: 0000000000000000 RSI: 00007fffdb857f1e RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007fffdb856540 R14: 00007f7f8edf0000 R15: 000055c92ee5c4d8
 </TASK>

The buggy address belongs to the page:
page:ffffea00016ef900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bbe4
head:ffffea00016ef900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO), pid 4289, ts 89835392322, free_ts 89698080619
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 kmalloc_order+0x40/0x150 mm/slab_common.c:986
 kmalloc_order_trace+0x14/0xf0 mm/slab_common.c:1002
 kmalloc_large include/linux/slab.h:536 [inline]
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:738 [inline]
 em28xx_v4l2_init+0xd5/0x2cd0 drivers/media/usb/em28xx/em28xx-video.c:2550
 em28xx_init_extension+0x118/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1126
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396
 free_nonslab_page+0xde/0x150 mm/slub.c:3540
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2130 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x155a/0x2cd0 drivers/media/usb/em28xx/em28xx-video.c:2919
 em28xx_init_extension+0x118/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1126
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Memory state around the buggy address:
 ffff88805bbe4880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88805bbe4900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88805bbe4980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                     ^
 ffff88805bbe4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88805bbe4a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================