Extracting prog: 4m33.39104425s
Minimizing prog: 1h34m26.821809764s
Simplifying prog options: 0s
Extracting C: 45.815828163s
Simplifying C: 30m3.370079331s


extracting reproducer from 16 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close-setns-socket-ioctl$sock_inet_SIOCSIFFLAGS-socket$packet
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)
r5 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000001700)={'syzkaller0\x00', 0x41})
socket$packet(0x11, 0x3, 0x300)

program did not crash
single: failed to extract reproducer
bisect: bisecting 16 programs with base timeout 30s
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 3, 26, 12, 20, 9, 23, 10, 4, 13, 25, 2, 5, 28, 30, 3]
detailed listing:
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x0, 0x24, 0x1, 0x0, 0x10000, {0x0, 0xffff}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x64}}}]}, 0x3c}}, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
bind$packet(r1, &(0x7f0000000100)={0x11, 0x300, 0x1, 0x1, 0x0, 0x6, @local}, 0x14)
setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000200)=@req3={0x10000, 0x1, 0x10000, 0x1}, 0x1c)
pipe2(&(0x7f0000000300)={<r2=>0x0, <r3=>0x0}, 0x0)
write(r3, &(0x7f0000000400)="01000000", 0x4)
read(r2, &(0x7f0000000000), 0x4)
sendmsg(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0)
executing program 2:
syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140), 0x1, 0x8a, &(0x7f0000000180)="$eJzszqENAkEUBNDhDKhrAEEH1wOlECQ4FISEimiFEugAgcUcYsGsxCy5vJf8n0zGzO11XaZPxksyVg7H026zLz9MUpdknmSRZNWX/FiXbvbp78/z9nut9wIAAL/rMtR5aDYGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4A+9AwAA///rYCNS")
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/a\x00', 0x42, 0x1ff)
renameat(0xffffffffffffff9c, &(0x7f0000000280)='./file0/a\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0/b\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
symlinkat(&(0x7f0000000a00)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00')
ftruncate(0xffffffffffffffff, 0x100000)
close(0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/functions/mass_storage.usb0/lun.0/file\x00', 0x1, 0x0)
write(r2, &(0x7f0000001100)='./backing_file\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000d00)='dummy_udc.0\x00', 0xb)
close(r3)
nanosleep(&(0x7f0000001200)={0x1}, 0x0)
r4 = syz_open_dev$sg(&(0x7f0000001300), 0x0, 0x2)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r4, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000001400), 0x1, 0x2)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r5, 0x2)
syz_open_dev$sg(&(0x7f0000001500), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001600), 0x3, 0x2)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r6, 0x2)
executing program 2:
r0 = syz_mount_image$btrfs(&(0x7f0000000000), &(0x7f00000015c0)='./file0\x00', 0x0, &(0x7f0000001600), 0x0, 0x559e, &(0x7f0000005680)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR")
ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000000100)={{}, 'sub1\x00'})
write(0xffffffffffffffff, 0x0, 0x0)
close(0xffffffffffffffff)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/sub1/f1\x00', 0x2, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0/snap1\x00', 0x0, 0x0)
ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r2, 0x4008941a, &(0x7f0000000080)=0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./out_pipe\x00', 0x42, 0x1ff)
ioctl$BTRFS_IOC_SEND(r2, 0x40489426, &(0x7f0000000800)={{r3}, 0x0, 0x0, 0x100, 0x0, 0x1})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\n\x00', 0x4)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='7:0\n\x00', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)='raid1\n\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000900)='1\n\x00', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/dev-loop0/state\x00', 0x1, 0x0)
write(r4, &(0x7f0000000b00)='writemostly\n\x00', 0xc)
write(0xffffffffffffffff, &(0x7f0000000d00)='active\n\x00', 0x7)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0)
write(r5, &(0x7f0000000f00)='+8\n\x00', 0x3)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0x1d6b\x00', 0x7)
close(r0)
write(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g1/functions/rndis.usb0/ifname\x00', 0x1, 0x0)
write(r1, &(0x7f0000000f00)='syzkaller0\x00', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='md0\n\x00', 0x4)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='7:0\n\x00', 0x4)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)='raid1\n\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000900)='1\n\x00', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/dev-loop0/state\x00', 0x1, 0x0)
write(r4, &(0x7f0000000b00)='writemostly\n\x00', 0xc)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000d00)='active\n\x00', 0x7)
close(r5)
close(0xffffffffffffffff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0)
write(r6, &(0x7f0000001100)='10\n\x00', 0x3)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0)
write(r0, &(0x7f0000001300)='1\n', 0x2)
executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r0, 0x0, 0x0)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2)
close(r0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0x0, 0x3)
r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0x0, &(0x7f0000000040)={0x200000})
ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x0, &(0x7f0000000080)={0x0, 0x200000, 0x8})
r3 = ioctl$KVM_CREATE_VCPU(r1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x0, &(0x7f00000000c0)={0x0, 0x4, 0x0, 0x100000, 0x0, 0x0, r2})
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0x0, &(0x7f0000000140)={0x0, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x0, &(0x7f00000000c0)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0, r2})
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x0, &(0x7f00000000c0)={0x0, 0x4, 0x0, 0x100000, 0x0, 0x0, r2})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0x0, &(0x7f0000000140)={0x0, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x0, &(0x7f0000000100)={0x1, 0x4, 0x100000, 0x100000, 0x0, 0x0, r2, 0x100000})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0x0, &(0x7f0000000140)={0x100000, 0x100000})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='md0\n\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='raid5\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r2, &(0x7f0000000280)='65536\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='3\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r4, &(0x7f0000000380)='1:0\n\x00', 0x4)
write(r4, &(0x7f00000003c0)='1:1\n\x00', 0x4)
write(r4, &(0x7f0000000400)='1:2\n\x00', 0x4)
write(0xffffffffffffffff, &(0x7f0000000480)='0\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000580)='2\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='active\n\x00', 0x7)
write(r4, &(0x7f0000000640)='1:3\n\x00', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/dev-ram3/slot\x00', 0x1, 0x0)
write(r6, &(0x7f00000006c0)='3\n\x00', 0x2)
write(r3, &(0x7f0000000700)='4\n\x00', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r7, &(0x7f0000000780)='reshape\n\x00', 0x8)
executing program 4:
r0 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r0, &(0x7f0000000300)={0x2, 0x1500, @loopback}, 0x10)
executing program 0:
r0 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1500, @loopback}, 0x10)
listen(r0, 0x5)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000000400)='227 Entering Passive Mode (127,0,0,1,19,136)\r\n', 0x30, 0x0, 0x0, 0x0)
executing program 1:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)
r5 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000001700)={'syzkaller0\x00', 0x41})
socket$packet(0x11, 0x3, 0x300)
executing program 4:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000000), &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0x1d6b\n', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000700)='0x0104\n', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='fedcba9876543210\n', 0x11)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000e00)='Multifunction Gadget\n', 0x15)
close(0xffffffffffffffff)
mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r3, &(0x7f0000001200)='Conf 1\n', 0x7)
close(r3)
mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.syzkaller0\x00', 0x1ff)
symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.syzkaller0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.syzkaller0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001700)='dummy_udc.0\n', 0xc)
close(r4)
nanosleep(&(0x7f0000002000)={0x0, 0xbebc200}, 0x0)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001800)={'syzkaller0\x00', <r6=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000001900)={'syzkaller0\x00', 0x1})
bind$packet(r5, &(0x7f0000001a00)={0x11, 0x300, r6, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14)
write(r5, &(0x7f0000001b00)="0102030405060708090a0b0c0d0e0f", 0xf)
executing program 2:
r0 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x3, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f00000012c0)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f00000017c0)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0})

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close-setns-socket-ioctl$sock_inet_SIOCSIFFLAGS-socket$packet
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)
r5 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000001700)={'syzkaller0\x00', 0x41})
socket$packet(0x11, 0x3, 0x300)

program crashed: WARNING: refcount bug in usb_add_gadget
single: successfully extracted reproducer
found reproducer with 28 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close-setns-socket-ioctl$sock_inet_SIOCSIFFLAGS
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)
r5 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000001700)={'syzkaller0\x00', 0x41})

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close-setns-socket
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)
socket(0x2, 0x2, 0x0)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close-setns
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)
setns(0xc9, 0x0)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write-close
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)
close(r4)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-openat
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-chdir-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
write(0xffffffffffffffff, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-close-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-write-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r3, &(0x7f0000001000)='syzkaller%d', 0xb)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-openat-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-write-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000c00)='0xa4a1', 0x6)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-close-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
close(r2)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-write-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r2, &(0x7f0000000a00)='0x0525', 0x6)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-openat-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: WARNING: refcount bug in usb_add_gadget
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mount-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mkdir-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-close-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-write-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-openat-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-close-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(0xffffffffffffffff)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r0)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400), 0x0)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', 0x0, 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(0x0, 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: WARNING: refcount bug in usb_add_gadget
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
program did not crash
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-close-mkdir-mount-mkdir-chdir-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
close(r1)
mkdir(&(0x7f0000000600)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./config\x00', &(0x7f0000000700)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
chdir(&(0x7f0000001100)='./config/usb_gadget/g1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001500)='dummy_udc.0', 0xb)

program crashed: KASAN: use-after-free Read in driver_deferred_probe_del
validation run: crashed=true
reproducing took 2h13m28.710305841s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in list_empty include/linux/list.h:292 [inline]
BUG: KASAN: use-after-free in driver_deferred_probe_del+0x63/0x240 drivers/base/dd.c:148
Read of size 8 at addr ffff88802fd930e0 by task syz.3.31/4498

CPU: 1 PID: 4498 Comm: syz.3.31 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 list_empty include/linux/list.h:292 [inline]
 driver_deferred_probe_del+0x63/0x240 drivers/base/dd.c:148
 device_del+0x64f/0xa80 drivers/base/core.c:3902
 usb_del_gadget+0x18c/0x250 drivers/usb/gadget/udc/core.c:1580
 usb_del_gadget_udc+0x11/0x30 drivers/usb/gadget/udc/core.c:1603
 dummy_udc_remove+0x54/0x60 drivers/usb/gadget/udc/dummy_hcd.c:1141
 platform_remove+0x92/0xe0 drivers/base/platform.c:1422
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x47d/0x7c0 drivers/base/dd.c:1305
 unbind_store+0x2e2/0x300 drivers/base/bus.c:193
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc06499e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff4889ef68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc064c25fa0 RCX: 00007fc06499e0d9
RDX: 000000000000000b RSI: 0000200000000400 RDI: 0000000000000003
RBP: 00007fc064a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc064c25fac R14: 00007fc064c25fa0 R15: 00007fc064c25fa0
 </TASK>

Allocated by task 4496:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 device_private_init drivers/base/core.c:3541 [inline]
 device_add+0xb2/0x1050 drivers/base/core.c:3591
 usb_add_gadget+0x47c/0x6f0 drivers/usb/gadget/udc/core.c:1450
 usb_add_gadget_udc_release+0x198/0x1e0 drivers/usb/gadget/udc/core.c:1506
 dummy_udc_probe+0x686/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1120
 platform_probe+0x137/0x1c0 drivers/base/platform.c:1400
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131
 bind_store+0x33b/0x380 drivers/base/bus.c:216
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 4498:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x217/0x450 lib/kobject.c:729
 bus_remove_device+0x2bf/0x400 drivers/base/bus.c:527
 device_del+0x63f/0xa80 drivers/base/core.c:3900
 usb_del_gadget+0x18c/0x250 drivers/usb/gadget/udc/core.c:1580
 usb_del_gadget_udc+0x11/0x30 drivers/usb/gadget/udc/core.c:1603
 dummy_udc_remove+0x54/0x60 drivers/usb/gadget/udc/dummy_hcd.c:1141
 platform_remove+0x92/0xe0 drivers/base/platform.c:1422
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x47d/0x7c0 drivers/base/dd.c:1305
 unbind_store+0x2e2/0x300 drivers/base/bus.c:193
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff88802fd93000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
 512-byte region [ffff88802fd93000, ffff88802fd93200)

The buggy address belongs to the physical page:
page:ffffea0000bf6400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fd90
head:ffffea0000bf6400 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21081982765, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2115
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc_node_track_caller+0xa0/0x240 mm/slab_common.c:956
 kmalloc_reserve net/core/skbuff.c:446 [inline]
 __alloc_skb+0x226/0x7d0 net/core/skbuff.c:515
 alloc_skb include/linux/skbuff.h:1303 [inline]
 alloc_uevent_skb+0x7d/0x230 lib/kobject_uevent.c:290
 uevent_net_broadcast_tagged lib/kobject_uevent.c:351 [inline]
 kobject_uevent_net_broadcast+0x17e/0x530 lib/kobject_uevent.c:412
 kobject_uevent_env+0x555/0x890 lib/kobject_uevent.c:608
 netdev_queue_add_kobject net/core/net-sysfs.c:1675 [inline]
 netdev_queue_update_kobjects+0x238/0x480 net/core/net-sysfs.c:1716
 register_queue_kobjects net/core/net-sysfs.c:1777 [inline]
 netdev_register_kobject+0x273/0x320 net/core/net-sysfs.c:2017
 register_netdevice+0x133a/0x1b80 net/core/dev.c:10243
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802fd92f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802fd93000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802fd93080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff88802fd93100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802fd93180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in list_empty include/linux/list.h:292 [inline]
BUG: KASAN: use-after-free in driver_deferred_probe_del+0x63/0x240 drivers/base/dd.c:148
Read of size 8 at addr ffff88802fd930e0 by task syz.3.31/4498

CPU: 1 PID: 4498 Comm: syz.3.31 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 list_empty include/linux/list.h:292 [inline]
 driver_deferred_probe_del+0x63/0x240 drivers/base/dd.c:148
 device_del+0x64f/0xa80 drivers/base/core.c:3902
 usb_del_gadget+0x18c/0x250 drivers/usb/gadget/udc/core.c:1580
 usb_del_gadget_udc+0x11/0x30 drivers/usb/gadget/udc/core.c:1603
 dummy_udc_remove+0x54/0x60 drivers/usb/gadget/udc/dummy_hcd.c:1141
 platform_remove+0x92/0xe0 drivers/base/platform.c:1422
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x47d/0x7c0 drivers/base/dd.c:1305
 unbind_store+0x2e2/0x300 drivers/base/bus.c:193
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc06499e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff4889ef68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc064c25fa0 RCX: 00007fc06499e0d9
RDX: 000000000000000b RSI: 0000200000000400 RDI: 0000000000000003
RBP: 00007fc064a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc064c25fac R14: 00007fc064c25fa0 R15: 00007fc064c25fa0
 </TASK>

Allocated by task 4496:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 device_private_init drivers/base/core.c:3541 [inline]
 device_add+0xb2/0x1050 drivers/base/core.c:3591
 usb_add_gadget+0x47c/0x6f0 drivers/usb/gadget/udc/core.c:1450
 usb_add_gadget_udc_release+0x198/0x1e0 drivers/usb/gadget/udc/core.c:1506
 dummy_udc_probe+0x686/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1120
 platform_probe+0x137/0x1c0 drivers/base/platform.c:1400
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131
 bind_store+0x33b/0x380 drivers/base/bus.c:216
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 4498:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x217/0x450 lib/kobject.c:729
 bus_remove_device+0x2bf/0x400 drivers/base/bus.c:527
 device_del+0x63f/0xa80 drivers/base/core.c:3900
 usb_del_gadget+0x18c/0x250 drivers/usb/gadget/udc/core.c:1580
 usb_del_gadget_udc+0x11/0x30 drivers/usb/gadget/udc/core.c:1603
 dummy_udc_remove+0x54/0x60 drivers/usb/gadget/udc/dummy_hcd.c:1141
 platform_remove+0x92/0xe0 drivers/base/platform.c:1422
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x47d/0x7c0 drivers/base/dd.c:1305
 unbind_store+0x2e2/0x300 drivers/base/bus.c:193
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff88802fd93000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
 512-byte region [ffff88802fd93000, ffff88802fd93200)

The buggy address belongs to the physical page:
page:ffffea0000bf6400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fd90
head:ffffea0000bf6400 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21081982765, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2115
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc_node_track_caller+0xa0/0x240 mm/slab_common.c:956
 kmalloc_reserve net/core/skbuff.c:446 [inline]
 __alloc_skb+0x226/0x7d0 net/core/skbuff.c:515
 alloc_skb include/linux/skbuff.h:1303 [inline]
 alloc_uevent_skb+0x7d/0x230 lib/kobject_uevent.c:290
 uevent_net_broadcast_tagged lib/kobject_uevent.c:351 [inline]
 kobject_uevent_net_broadcast+0x17e/0x530 lib/kobject_uevent.c:412
 kobject_uevent_env+0x555/0x890 lib/kobject_uevent.c:608
 netdev_queue_add_kobject net/core/net-sysfs.c:1675 [inline]
 netdev_queue_update_kobjects+0x238/0x480 net/core/net-sysfs.c:1716
 register_queue_kobjects net/core/net-sysfs.c:1777 [inline]
 netdev_register_kobject+0x273/0x320 net/core/net-sysfs.c:2017
 register_netdevice+0x133a/0x1b80 net/core/dev.c:10243
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802fd92f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802fd93000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802fd93080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff88802fd93100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802fd93180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================