Extracting prog: 2h56m24.156997304s
Minimizing prog: 2h6m20.199666769s
Simplifying prog options: 0s
Extracting C: 23.477872008s
Simplifying C: 41m5.126456273s


extracting reproducer from 67 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-prlimit64-sched_setscheduler-mmap-madvise-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE
detailed listing:
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdir-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-sendmsg$TCPDIAG_GETSOCK-sendmsg$nl_route_sched-sendto-recvmmsg-write-close-openat-write-setsockopt$netlink_NETLINK_ADD_MEMBERSHIP-connect$inet6-socketpair$tipc-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-sendmsg$TCPDIAG_GETSOCK-sendmsg$nl_route_sched-sendto-recvmmsg-write-close-openat-write-setsockopt$netlink_NETLINK_ADD_MEMBERSHIP-connect$inet6-socketpair$tipc-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-syz_usb_connect-socket$inet-getsockopt$IPT_SO_GET_INFO
detailed listing:
executing program 0:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-syz_usb_connect-socket$inet-getsockopt$IPT_SO_GET_INFO
detailed listing:
executing program 0:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-sendmsg$inet-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun
detailed listing:
executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-sendmsg$inet-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun
detailed listing:
executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer-mprotect-syz_open_dev$sndctrl-openat$fuse-openat$mice-openat-openat-openat$cgroup_procs-syz_open_dev$dri-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_devices-open
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer-mprotect-syz_open_dev$sndctrl-openat$fuse-openat$mice-openat-openat-openat$cgroup_procs-syz_open_dev$dri-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_devices-open
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-close-openat-write-close-mkdirat-mkdirat-openat-write-close-openat-write-close-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-close-openat-write-close-mkdirat-mkdirat-openat-write-close-openat-write-close-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-getdents64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-getdents64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-socket$kcm-socket$unix-ioctl$sock_SIOCGIFINDEX-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-openat$tun-close-socket$nl_generic-ioctl$SIOCSIFHWADDR-ioctl$sock_SIOCGIFINDEX-sendmsg$kcm
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 67 programs with base timeout 30s
testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 6, 18, 3, 19, 15, 7, 3, 19, 25, 18, 24, 16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4, 24, 4, 17, 25, 7, 7, 3, 5, 4, 17, 9, 4, 4, 8, 23, 16, 16, 2, 16, 16, 16, 7, 7, 2, 4, 21, 2, 9, 2, 7, 10, 7, 7, 8, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0xd0, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000000)=0x3, 0x4)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x101}]}, 0x10)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = epoll_create1(0x80000)
syz_open_dev$mouse(&(0x7f00000001c0), 0x2, 0xd83)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x12)
getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x401}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
fallocate(r2, 0x0, 0x0, 0x1000f4)
pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x29000, 0x3)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x8000001c})
landlock_restrict_self(0xffffffffffffffff, 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='dev\x00', &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0)
ioctl(r0, 0x5427, 0x0)
executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x20000)
prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890)
r9 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xbc58}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x7fe0, 0x8, 0x61d, 0x3}, {0x1, 0x2, 0x6, 0x101, 0x6d0, 0xffffffff}, 0x2003, 0x33, 0xe01}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000080}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r7 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 0:
r0 = inotify_init()
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8, 0x2)
write$binfmt_misc(r1, &(0x7f0000000040), 0x4)
r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r3 = fcntl$dupfd(r2, 0x0, r2)
write$binfmt_script(r3, &(0x7f0000000380), 0x48d43fe9)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x109082)
openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x20200)
write$binfmt_elf32(r0, &(0x7f0000002cc0)={{0x7f, 0x45, 0x4c, 0x46, 0xd, 0x7, 0x6, 0x8, 0x588000000000, 0x2, 0x6, 0x2, 0x35b, 0x38, 0xbb, 0x5, 0x6, 0x20, 0x1, 0x3ee5, 0xfff8, 0xc000}, [{0x60000000, 0x5, 0x4, 0x6, 0x802, 0x8, 0x9, 0x7}], "", ['\x00']}, 0x158)
executing program 0:
mkdir(&(0x7f0000000150)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_syz/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='syzkaller%d\x00', 0xc)
close(r0)
symlink(&(0x7f0000000800)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', &(0x7f0000000900)='./config/usb_gadget/g_syz/configs/c.1/ecm.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_syz/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='dummy_udc.0', 0xb)
close(r1)
clock_nanosleep(0x0, 0x0, &(0x7f0000000c00)={0x1}, 0x0)
r2 = socket(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000d00)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000e00)={'syzkaller0\x00', <r3=>0x0})
r4 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r4, &(0x7f0000000f00)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @random='abcdef'}, 0x14)
write(r4, &(0x7f0000001000)='hello world', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 1:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
ioctl(r0, 0xc0104d03, &(0x7f0000000900)="000001")
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 5:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mysys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000b00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000c00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000d00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000e00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000f00)='P\x00')
nanosleep(&(0x7f0000001080)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000001100), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000001200), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000001300), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001400), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001500)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001700)}, &(0x7f0000001600)="2a000000000000000100", &(0x7f0000001900), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001a00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001c00)}, &(0x7f0000001b00)="2a000000000000000100", &(0x7f0000001e00), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001f00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002100)}, &(0x7f0000002000)="2a000000000000000100", &(0x7f0000002300), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000002400)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002600)}, &(0x7f0000002500)="2a000000000000000100", &(0x7f0000002800), 0x4e20, 0x0, 0x0, 0x0})
executing program 5:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 36:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x400}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x10000}]}]}, 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000240)={&(0x7f0000000280)={0x4c, 0x9, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1}]}]}, 0x4c}}, 0x0)
executing program 4:
syz_usb_connect(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa090400000effffff00070581024000000705820240000007058302400000070584024000000705850240000007058602400000070587024000000705010240000007050202"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f00000014c0)="5c64e9d542f372633819fe534e7430bbf282dfd6b128acf2d6099cdb18c913d22f7d565ac2e8898818824d19a00c439ef3c3acdb1463032339d933d0bd25e7c1793ba6dfa19b2a4a4d9b3837b6cc65e679c5c6bb09", 0x55)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44000}, 0x2)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000883}, 0x80)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="540000000a0601020000000000000000020000000900020073797a310000000005000100070000002c0007800c00018008000140ffffffff0500070029000000060004404e2100000c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
executing program 4:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 37:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 8:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='1', 0x1)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000380)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/uevent_helper', 0x1, 0x0)
write(r0, &(0x7f0000000080)='maxtcpc 0x50\n\x00', 0xd)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 38:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket$netlink(0x10, 0x3, 0x0)
preadv(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/8, 0x8}], 0x1, 0xe, 0x4)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r2, 0x0)
executing program 9:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$TCFLSH(r1, 0x400455c8, 0x1)
ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000140)=0xffffffc0)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0xfc)
ioctl$TIOCSTI(r0, 0x5412, 0x0)
executing program 7:
r0 = mq_open(&(0x7f0000000100)='^\'\x00', 0x42, 0x53, &(0x7f0000000180)={0x8000, 0x2, 0x2})
mq_timedsend(r0, &(0x7f0000000200)="8b9247", 0x3, 0x9, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a400010102030109022000010100c0320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x15, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000200)="1100000001000000000400"/28})
executing program 9:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
executing program 9:
r0 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x2)
close(r0)
executing program 9:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)
executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xffffffff, 0x6, 0x20, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/32, 0x1, 0x0, 0x0, 0x0})
executing program 7:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x0, 0x40c00)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_mptcp(0xa, 0x1, 0x106)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x8, 0x399})
syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfa, 0x0}}, 0x1c)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000000)={0xa000000000000000, 0x10000, 0xe6, 0x2, 0xd})
io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd)
executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001"], 0x54)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@probe_response={{{}, {}, @device_b}, 0x100000001, @random, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @void, @void, @void}, 0x2e)
executing program 2:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db444506fa06b4a8039bd20bd8fcff97907c13395389388b043fa008e5b979", 0x60)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4)
mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1db)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0)
writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000240)="edec4c3ba59c631a246feb084a50ac6e072246d91e4cacb00bcbf40a014ad8d1faea2c5695aabc5130bfd91abd1f078fbf661a8c91b75dde683536e4697fdc", 0x3f}], 0x1)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 17 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-prlimit64-sched_setscheduler-mmap-madvise-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE
detailed listing:
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdir-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-sendmsg$TCPDIAG_GETSOCK-sendmsg$nl_route_sched-sendto-recvmmsg-write-close-openat-write-setsockopt$netlink_NETLINK_ADD_MEMBERSHIP-connect$inet6-socketpair$tipc-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-sendmsg$TCPDIAG_GETSOCK-sendmsg$nl_route_sched-sendto-recvmmsg-write-close-openat-write-setsockopt$netlink_NETLINK_ADD_MEMBERSHIP-connect$inet6-socketpair$tipc-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-syz_usb_connect-socket$inet-getsockopt$IPT_SO_GET_INFO
detailed listing:
executing program 0:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-syz_usb_connect-socket$inet-getsockopt$IPT_SO_GET_INFO
detailed listing:
executing program 0:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-sendmsg$inet-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun
detailed listing:
executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-sendmsg$inet-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun
detailed listing:
executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer-mprotect-syz_open_dev$sndctrl-openat$fuse-openat$mice-openat-openat-openat$cgroup_procs-syz_open_dev$dri-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_devices-open
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer2-openat$sequencer-openat$sequencer-mprotect-syz_open_dev$sndctrl-openat$fuse-openat$mice-openat-openat-openat$cgroup_procs-syz_open_dev$dri-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_devices-open
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-close-openat-write-close-mkdirat-mkdirat-openat-write-close-openat-write-close-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-close-openat-write-close-mkdirat-mkdirat-openat-write-close-openat-write-close-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-getdents64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-getdents64
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-socket$kcm-socket$unix-ioctl$sock_SIOCGIFINDEX-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-openat$tun-close-socket$nl_generic-ioctl$SIOCSIFHWADDR-ioctl$sock_SIOCGIFINDEX-sendmsg$kcm
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 67 programs with base timeout 1m40s
testing program (duration=1m56s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 6, 18, 3, 19, 15, 7, 3, 19, 25, 18, 24, 16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4, 24, 4, 17, 25, 7, 7, 3, 5, 4, 17, 9, 4, 4, 8, 23, 16, 16, 2, 16, 16, 16, 7, 7, 2, 4, 21, 2, 9, 2, 7, 10, 7, 7, 8, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0xd0, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000000)=0x3, 0x4)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x101}]}, 0x10)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = epoll_create1(0x80000)
syz_open_dev$mouse(&(0x7f00000001c0), 0x2, 0xd83)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x12)
getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x401}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
fallocate(r2, 0x0, 0x0, 0x1000f4)
pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x29000, 0x3)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x8000001c})
landlock_restrict_self(0xffffffffffffffff, 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='dev\x00', &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0)
ioctl(r0, 0x5427, 0x0)
executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x20000)
prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890)
r9 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xbc58}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x7fe0, 0x8, 0x61d, 0x3}, {0x1, 0x2, 0x6, 0x101, 0x6d0, 0xffffffff}, 0x2003, 0x33, 0xe01}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000080}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r7 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 0:
r0 = inotify_init()
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8, 0x2)
write$binfmt_misc(r1, &(0x7f0000000040), 0x4)
r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r3 = fcntl$dupfd(r2, 0x0, r2)
write$binfmt_script(r3, &(0x7f0000000380), 0x48d43fe9)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x109082)
openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x20200)
write$binfmt_elf32(r0, &(0x7f0000002cc0)={{0x7f, 0x45, 0x4c, 0x46, 0xd, 0x7, 0x6, 0x8, 0x588000000000, 0x2, 0x6, 0x2, 0x35b, 0x38, 0xbb, 0x5, 0x6, 0x20, 0x1, 0x3ee5, 0xfff8, 0xc000}, [{0x60000000, 0x5, 0x4, 0x6, 0x802, 0x8, 0x9, 0x7}], "", ['\x00']}, 0x158)
executing program 0:
mkdir(&(0x7f0000000150)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_syz/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='syzkaller%d\x00', 0xc)
close(r0)
symlink(&(0x7f0000000800)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', &(0x7f0000000900)='./config/usb_gadget/g_syz/configs/c.1/ecm.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_syz/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='dummy_udc.0', 0xb)
close(r1)
clock_nanosleep(0x0, 0x0, &(0x7f0000000c00)={0x1}, 0x0)
r2 = socket(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000d00)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000e00)={'syzkaller0\x00', <r3=>0x0})
r4 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r4, &(0x7f0000000f00)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @random='abcdef'}, 0x14)
write(r4, &(0x7f0000001000)='hello world', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 1:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
ioctl(r0, 0xc0104d03, &(0x7f0000000900)="000001")
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 5:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mysys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000b00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000c00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000d00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000e00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000f00)='P\x00')
nanosleep(&(0x7f0000001080)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000001100), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000001200), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000001300), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001400), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001500)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001700)}, &(0x7f0000001600)="2a000000000000000100", &(0x7f0000001900), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001a00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001c00)}, &(0x7f0000001b00)="2a000000000000000100", &(0x7f0000001e00), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001f00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002100)}, &(0x7f0000002000)="2a000000000000000100", &(0x7f0000002300), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000002400)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002600)}, &(0x7f0000002500)="2a000000000000000100", &(0x7f0000002800), 0x4e20, 0x0, 0x0, 0x0})
executing program 5:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 36:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x400}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x10000}]}]}, 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000240)={&(0x7f0000000280)={0x4c, 0x9, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1}]}]}, 0x4c}}, 0x0)
executing program 4:
syz_usb_connect(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa090400000effffff00070581024000000705820240000007058302400000070584024000000705850240000007058602400000070587024000000705010240000007050202"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f00000014c0)="5c64e9d542f372633819fe534e7430bbf282dfd6b128acf2d6099cdb18c913d22f7d565ac2e8898818824d19a00c439ef3c3acdb1463032339d933d0bd25e7c1793ba6dfa19b2a4a4d9b3837b6cc65e679c5c6bb09", 0x55)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44000}, 0x2)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000883}, 0x80)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="540000000a0601020000000000000000020000000900020073797a310000000005000100070000002c0007800c00018008000140ffffffff0500070029000000060004404e2100000c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
executing program 4:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 37:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 8:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='1', 0x1)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000380)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/uevent_helper', 0x1, 0x0)
write(r0, &(0x7f0000000080)='maxtcpc 0x50\n\x00', 0xd)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 38:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket$netlink(0x10, 0x3, 0x0)
preadv(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/8, 0x8}], 0x1, 0xe, 0x4)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r2, 0x0)
executing program 9:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$TCFLSH(r1, 0x400455c8, 0x1)
ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000140)=0xffffffc0)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0xfc)
ioctl$TIOCSTI(r0, 0x5412, 0x0)
executing program 7:
r0 = mq_open(&(0x7f0000000100)='^\'\x00', 0x42, 0x53, &(0x7f0000000180)={0x8000, 0x2, 0x2})
mq_timedsend(r0, &(0x7f0000000200)="8b9247", 0x3, 0x9, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a400010102030109022000010100c0320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x15, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000200)="1100000001000000000400"/28})
executing program 9:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
executing program 9:
r0 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x2)
close(r0)
executing program 9:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)
executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xffffffff, 0x6, 0x20, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/32, 0x1, 0x0, 0x0, 0x0})
executing program 7:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x0, 0x40c00)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_mptcp(0xa, 0x1, 0x106)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x8, 0x399})
syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfa, 0x0}}, 0x1c)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000000)={0xa000000000000000, 0x10000, 0xe6, 0x2, 0xd})
io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd)
executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001"], 0x54)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@probe_response={{{}, {}, @device_b}, 0x100000001, @random, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @void, @void, @void}, 0x2e)
executing program 2:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db444506fa06b4a8039bd20bd8fcff97907c13395389388b043fa008e5b979", 0x60)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4)
mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1db)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0)
writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000240)="edec4c3ba59c631a246feb084a50ac6e072246d91e4cacb00bcbf40a014ad8d1faea2c5695aabc5130bfd91abd1f078fbf661a8c91b75dde683536e4697fdc", 0x3f}], 0x1)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
bisect: bisecting 67 programs
bisect: split chunks (needed=false): <67>
bisect: split chunk #0 of len 67 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m51s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 4, 17, 25, 7, 7, 3, 5, 4, 17, 9, 4, 4, 8, 23, 16, 16, 2, 16, 16, 16, 7, 7, 2, 4, 21, 2, 9, 2, 7, 10, 7, 7, 8, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
ioctl(r0, 0xc0104d03, &(0x7f0000000900)="000001")
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 5:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mysys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000b00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000c00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000d00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000e00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000f00)='P\x00')
nanosleep(&(0x7f0000001080)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000001100), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000001200), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000001300), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001400), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001500)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001700)}, &(0x7f0000001600)="2a000000000000000100", &(0x7f0000001900), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001a00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001c00)}, &(0x7f0000001b00)="2a000000000000000100", &(0x7f0000001e00), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001f00)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002100)}, &(0x7f0000002000)="2a000000000000000100", &(0x7f0000002300), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000002400)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000002600)}, &(0x7f0000002500)="2a000000000000000100", &(0x7f0000002800), 0x4e20, 0x0, 0x0, 0x0})
executing program 5:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 36:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1c0000f50403090005000f000080fb00000002"], 0x7a)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x400}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x10000}]}]}, 0x60}}, 0x0)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000240)={&(0x7f0000000280)={0x4c, 0x9, 0x6, 0x605, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1}]}]}, 0x4c}}, 0x0)
executing program 4:
syz_usb_connect(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa090400000effffff00070581024000000705820240000007058302400000070584024000000705850240000007058602400000070587024000000705010240000007050202"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f00000014c0)="5c64e9d542f372633819fe534e7430bbf282dfd6b128acf2d6099cdb18c913d22f7d565ac2e8898818824d19a00c439ef3c3acdb1463032339d933d0bd25e7c1793ba6dfa19b2a4a4d9b3837b6cc65e679c5c6bb09", 0x55)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44000}, 0x2)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000883}, 0x80)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="540000000a0601020000000000000000020000000900020073797a310000000005000100070000002c0007800c00018008000140ffffffff0500070029000000060004404e2100000c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x80)
executing program 4:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 37:
unshare(0x62040200)
syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
getsockopt$IPT_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00', 0x0, [0x8, 0x5, 0x2, 0x4, 0x8b34]}, &(0x7f0000000200)=0x54)
executing program 8:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r1, &(0x7f0000000380)='1', 0x1)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000380)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 8:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/uevent_helper', 0x1, 0x0)
write(r0, &(0x7f0000000080)='maxtcpc 0x50\n\x00', 0xd)
executing program 8:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 38:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'})
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 9:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket$netlink(0x10, 0x3, 0x0)
preadv(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/8, 0x8}], 0x1, 0xe, 0x4)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r2, 0x0)
executing program 9:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$TCFLSH(r1, 0x400455c8, 0x1)
ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000140)=0xffffffc0)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0xfc)
ioctl$TIOCSTI(r0, 0x5412, 0x0)
executing program 7:
r0 = mq_open(&(0x7f0000000100)='^\'\x00', 0x42, 0x53, &(0x7f0000000180)={0x8000, 0x2, 0x2})
mq_timedsend(r0, &(0x7f0000000200)="8b9247", 0x3, 0x9, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a400010102030109022000010100c0320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x15, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000200)="1100000001000000000400"/28})
executing program 9:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
executing program 9:
r0 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x2)
close(r0)
executing program 9:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)
executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xffffffff, 0x6, 0x20, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/32, 0x1, 0x0, 0x0, 0x0})
executing program 7:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x0, 0x40c00)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_mptcp(0xa, 0x1, 0x106)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x8, 0x399})
syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfa, 0x0}}, 0x1c)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000000)={0xa000000000000000, 0x10000, 0xe6, 0x2, 0xd})
io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd)
executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001"], 0x54)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@probe_response={{{}, {}, @device_b}, 0x100000001, @random, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @void, @void, @void}, 0x2e)
executing program 2:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db444506fa06b4a8039bd20bd8fcff97907c13395389388b043fa008e5b979", 0x60)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4)
mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1db)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0)
writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000240)="edec4c3ba59c631a246feb084a50ac6e072246d91e4cacb00bcbf40a014ad8d1faea2c5695aabc5130bfd91abd1f078fbf661a8c91b75dde683536e4697fdc", 0x3f}], 0x1)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
bisect: testing without sub-chunk 2/3
testing program (duration=1m51s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 6, 18, 3, 19, 15, 7, 3, 19, 25, 18, 24, 16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4, 2, 4, 21, 2, 9, 2, 7, 10, 7, 7, 8, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0xd0, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000000)=0x3, 0x4)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x101}]}, 0x10)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = epoll_create1(0x80000)
syz_open_dev$mouse(&(0x7f00000001c0), 0x2, 0xd83)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x12)
getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x401}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
fallocate(r2, 0x0, 0x0, 0x1000f4)
pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x29000, 0x3)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x8000001c})
landlock_restrict_self(0xffffffffffffffff, 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='dev\x00', &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0)
ioctl(r0, 0x5427, 0x0)
executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x20000)
prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890)
r9 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xbc58}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x7fe0, 0x8, 0x61d, 0x3}, {0x1, 0x2, 0x6, 0x101, 0x6d0, 0xffffffff}, 0x2003, 0x33, 0xe01}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000080}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r7 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 0:
r0 = inotify_init()
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8, 0x2)
write$binfmt_misc(r1, &(0x7f0000000040), 0x4)
r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r3 = fcntl$dupfd(r2, 0x0, r2)
write$binfmt_script(r3, &(0x7f0000000380), 0x48d43fe9)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x109082)
openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x20200)
write$binfmt_elf32(r0, &(0x7f0000002cc0)={{0x7f, 0x45, 0x4c, 0x46, 0xd, 0x7, 0x6, 0x8, 0x588000000000, 0x2, 0x6, 0x2, 0x35b, 0x38, 0xbb, 0x5, 0x6, 0x20, 0x1, 0x3ee5, 0xfff8, 0xc000}, [{0x60000000, 0x5, 0x4, 0x6, 0x802, 0x8, 0x9, 0x7}], "", ['\x00']}, 0x158)
executing program 0:
mkdir(&(0x7f0000000150)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_syz/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='syzkaller%d\x00', 0xc)
close(r0)
symlink(&(0x7f0000000800)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', &(0x7f0000000900)='./config/usb_gadget/g_syz/configs/c.1/ecm.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_syz/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='dummy_udc.0', 0xb)
close(r1)
clock_nanosleep(0x0, 0x0, &(0x7f0000000c00)={0x1}, 0x0)
r2 = socket(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000d00)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000e00)={'syzkaller0\x00', <r3=>0x0})
r4 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r4, &(0x7f0000000f00)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @random='abcdef'}, 0x14)
write(r4, &(0x7f0000001000)='hello world', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 1:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 7:
r0 = mq_open(&(0x7f0000000100)='^\'\x00', 0x42, 0x53, &(0x7f0000000180)={0x8000, 0x2, 0x2})
mq_timedsend(r0, &(0x7f0000000200)="8b9247", 0x3, 0x9, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a400010102030109022000010100c0320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x15, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000200)="1100000001000000000400"/28})
executing program 9:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
executing program 9:
r0 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x2)
close(r0)
executing program 9:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)
executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xffffffff, 0x6, 0x20, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/32, 0x1, 0x0, 0x0, 0x0})
executing program 7:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x0, 0x40c00)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_mptcp(0xa, 0x1, 0x106)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x8, 0x399})
syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfa, 0x0}}, 0x1c)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000000)={0xa000000000000000, 0x10000, 0xe6, 0x2, 0xd})
io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd)
executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001"], 0x54)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@probe_response={{{}, {}, @device_b}, 0x100000001, @random, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @void, @void, @void}, 0x2e)
executing program 2:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db444506fa06b4a8039bd20bd8fcff97907c13395389388b043fa008e5b979", 0x60)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4)
mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1db)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0)
writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000240)="edec4c3ba59c631a246feb084a50ac6e072246d91e4cacb00bcbf40a014ad8d1faea2c5695aabc5130bfd91abd1f078fbf661a8c91b75dde683536e4697fdc", 0x3f}], 0x1)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 6, 18, 3, 19, 15, 7, 3, 19, 25, 18, 24, 16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4]
detailed listing:
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0xd0, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000000)=0x3, 0x4)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x101}]}, 0x10)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = epoll_create1(0x80000)
syz_open_dev$mouse(&(0x7f00000001c0), 0x2, 0xd83)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x12)
getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x401}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
fallocate(r2, 0x0, 0x0, 0x1000f4)
pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x29000, 0x3)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x8000001c})
landlock_restrict_self(0xffffffffffffffff, 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='dev\x00', &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff0000000705810240000007050202400000"], 0x0)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0)
ioctl(r0, 0x5427, 0x0)
executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x20000)
prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x2, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890)
r9 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xbc58}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x7fe0, 0x8, 0x61d, 0x3}, {0x1, 0x2, 0x6, 0x101, 0x6d0, 0xffffffff}, 0x2003, 0x33, 0xe01}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000080}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r7 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 0:
r0 = inotify_init()
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8, 0x2)
write$binfmt_misc(r1, &(0x7f0000000040), 0x4)
r2 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r3 = fcntl$dupfd(r2, 0x0, r2)
write$binfmt_script(r3, &(0x7f0000000380), 0x48d43fe9)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x109082)
openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x20200)
write$binfmt_elf32(r0, &(0x7f0000002cc0)={{0x7f, 0x45, 0x4c, 0x46, 0xd, 0x7, 0x6, 0x8, 0x588000000000, 0x2, 0x6, 0x2, 0x35b, 0x38, 0xbb, 0x5, 0x6, 0x20, 0x1, 0x3ee5, 0xfff8, 0xc000}, [{0x60000000, 0x5, 0x4, 0x6, 0x802, 0x8, 0x9, 0x7}], "", ['\x00']}, 0x158)
executing program 0:
mkdir(&(0x7f0000000150)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_syz/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='syzkaller%d\x00', 0xc)
close(r0)
symlink(&(0x7f0000000800)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', &(0x7f0000000900)='./config/usb_gadget/g_syz/configs/c.1/ecm.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_syz/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='dummy_udc.0', 0xb)
close(r1)
clock_nanosleep(0x0, 0x0, &(0x7f0000000c00)={0x1}, 0x0)
r2 = socket(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000d00)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000e00)={'syzkaller0\x00', <r3=>0x0})
r4 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r4, &(0x7f0000000f00)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @random='abcdef'}, 0x14)
write(r4, &(0x7f0000001000)='hello world', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 1:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$inet6_udp(0xa, 0x2, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)=@newqdisc={0x2c, 0x24, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb}, {0xffff, 0xe}, {0x4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r4, &(0x7f0000000240)='100', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x7fffffff}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22004002}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000340)={0x1000})
close(0x3)
file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x64, 0x1000)
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)

program did not crash
bisect: split chunks (needed=true): <23>, <21>
bisect: split chunk #0 of len 23 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4, 2, 4, 21, 2, 9, 2, 7, 10, 7, 7, 8, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 7:
r0 = mq_open(&(0x7f0000000100)='^\'\x00', 0x42, 0x53, &(0x7f0000000180)={0x8000, 0x2, 0x2})
mq_timedsend(r0, &(0x7f0000000200)="8b9247", 0x3, 0x9, 0x0)
executing program 7:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a0a400010102030109022000010100c0320904000002ff0000000705010200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x15, 0x2)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000200)="1100000001000000000400"/28})
executing program 9:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
close(r0)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1)
executing program 9:
r0 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x2)
close(r0)
executing program 9:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='-2 -3\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000700)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='2', 0x1)
executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x53, 0xffffffff, 0x6, 0x20, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/32, 0x1, 0x0, 0x0, 0x0})
executing program 7:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f00000001c0), 0x0, 0x40c00)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_mptcp(0xa, 0x1, 0x106)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x8, 0x399})
syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfa, 0x0}}, 0x1c)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000000)={0xa000000000000000, 0x10000, 0xe6, 0x2, 0xd})
io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd)
executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYBLOB="50000000080211000001"], 0x54)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@probe_response={{{}, {}, @device_b}, 0x100000001, @random, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val, @void, @void, @void, @void, @void, @void}, 0x2e)
executing program 2:
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db444506fa06b4a8039bd20bd8fcff97907c13395389388b043fa008e5b979", 0x60)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
executing program 2:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4)
mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1db)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0)
writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000240)="edec4c3ba59c631a246feb084a50ac6e072246d91e4cacb00bcbf40a014ad8d1faea2c5695aabc5130bfd91abd1f078fbf661a8c91b75dde683536e4697fdc", 0x3f}], 0x1)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 21 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 3, 4, 4, 17, 3, 25, 25, 18, 18, 4, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='1d6b 0001 0\x00', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/regulator\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000400), 0x1000)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x210000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000880}, 0x20000080)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0)
write(0xffffffffffffffff, &(0x7f00000001c0), 0x0)
close(0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='100\x00', 0x3)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x1c)
pipe2(0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000))
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <11>, <10>
bisect: split chunk #0 of len 11 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 25, 18, 18, 4, 5, 23, 7, 13, 16, 25, 8, 4, 3, 6]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aeca, &(0x7f0000000200)="0100000000000000ffffffffffffffff")
executing program 2:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff)
mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='127.0.0.1\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='7777\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0)
mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='512\x00', 0x4)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='4\x00', 0x2)
close(r6)
nanosleep(&(0x7f00000006c0)={0xa}, 0x0)
executing program 6:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000840))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000680)=""/93, 0x0, 0x3000})
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000200))
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff)
pipe2(&(0x7f0000000200)={<r0=>0x0, <r1=>0x0}, 0x0)
write(r1, &(0x7f00000001c0)='functionfs\x00', 0xb)
read(r0, &(0x7f0000000100), 0xb)
mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)="030000003300000007000000010000000100000001000000090400000000000000090400000000000000090400000000000000", 0x33)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xff7fff01, 0x6, 0x3, 0x7, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x35, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8e, 0x6, 0x6, 0x0, 0x5, 0x4, 0x30a429b, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x5, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x7fff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x5, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x40b, 0x4, 0x5, 0xfffffffe, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x1, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0xa, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x1, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0xffffffff, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x4, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x4, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0x9, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x808, 0x6, 0x226, 0x5, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xffffff80, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 7:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x7, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x44000)
r8 = socket$kcm(0x11, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 25, 18, 18, 4, 25, 8, 4, 3, 6]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 34:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff)
mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='0x1d6b', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0x0104', 0x6)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0)
write(r2, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='44100,48000,88200,96000,176400,192000,352800,384000,705600,768000', 0x41)
close(r3)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000a00)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000b40)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000dc0)={{0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000f00)={{0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001180)={{0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000012c0)={{0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001400)={{0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000001540)={{0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'})
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 4, 25, 8, 4, 3, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 4, 3, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 4, 25, 8, 4]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)

program did not crash
bisect: split chunks (needed=true): <2>, <3>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25, 8, 4, 3, 6]
detailed listing:
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0)
close(r0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 25, 8, 4, 3, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
bisect: the chunk can be dropped
bisect: split chunk #1 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 4, 3, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='j', 0x1)
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 25, 8, 3, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
r0 = io_uring_setup(0x22a7, &(0x7f0000000000)={0x0, 0x547c, 0x1, 0x2, 0x379})
rt_sigsuspend(&(0x7f0000000280)={[0x5]}, 0x8)
io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000540)="1b8a0dd0", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
bisect: the chunk can be dropped
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 25, 8, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <2>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 8, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 25, 6]
detailed listing:
executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunks (needed=true): <1, final>, <1>, <1>, <1, final>
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 4 programs left: 

executing program 35:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
open(&(0x7f0000000040)='./file1\x00', 0x1a1142, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)


bisect: trying to concatenate
bisect: concatenate 4 entries
minimizing program #0 before concatenation
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: posix_spawnp failed
ignore low priority crash: SYZFAIL: posix_spawnp failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 25, 8, 6]
detailed listing:
executing program 0:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
socket$nl_netfilter(0x10, 0x3, 0xc)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
minimized 18 calls -> 5 calls
minimizing program #1 before concatenation
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 24, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r9, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r7, &(0x7f0000000300)='3\x00', 0x1)
ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000340)={0x1000})
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 23, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r8, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
write(r6, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 22, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r7, 0x409, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
suppressed program crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 22, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
write(r6, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 21, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
write(r6, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 20, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/self/fail-nth\x00', 0x1, 0x0)
write(r6, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: general protection fault in mon_notify
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 19, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 18, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: general protection fault in mon_notify
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 16, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
socket$nl_xfrm(0x10, 0x3, 0x6)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 16, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4, 0x8}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x44844)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 16, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x20040014)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 15, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: SYZFAIL: pipe failed
ignore low priority crash: SYZFAIL: pipe failed
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
close(r0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 13, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
close(r1)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='10', 0x2)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9, 8, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 0:
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
minimized 25 calls -> 10 calls
minimizing program #2 before concatenation
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 6, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 5, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
r0 = userfaultfd(0x80801)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 6]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 0:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
minimized 8 calls -> 4 calls
minimizing program #3 before concatenation
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
write(0xffffffffffffffff, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 4, 5]
detailed listing:
executing program 35:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
executing program 7:
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
executing program 0:
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
minimized 6 calls -> 6 calls
testing program (duration=2m31.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-openat$sequencer-mprotect-openat-openat$cgroup_devices-mkdirat-mount-write-openat-write-ioctl$KVM_CREATE_VM-mount-socket$nl_xfrm-sendmsg$nl_xfrm-write-madvise-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='3\x00', 0x1)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000240)={{&(0x7f0000574000/0x1000)=nil, 0x1000}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
bisect: concatenated prog does not crash
single: executing 17 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
write(0xffffffffffffffff, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)

program did not crash
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in event_handler
simplifying C reproducer
testing compiled C program (duration=8m18.958187757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in event_handler
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in event_handler
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in vhci_cleanup_unlink_list
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: KASAN: slab-use-after-free Read in event_handler
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program did not crash
validation run: crashed=false
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
validation run: crashed=true
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in vhci_shutdown_connection
validation run: crashed=true
testing program (duration=8m18.958187757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa)

program crashed: KASAN: slab-use-after-free Read in event_handler
validation run: crashed=true
reproducing took 6h6m58.753329829s
repro crashed as (corrupted=false):
vhci_hcd vhci_hcd.0: disconnect device
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
Read of size 1 at addr ffff8880551a94a8 by task kworker/u32:2/5599

CPU: 2 UID: 0 PID: 5599 Comm: kworker/u32:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usbip_event event_handler
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 __kasan_check_byte+0x36/0x50 mm/kasan/common.c:574
 kasan_check_byte include/linux/kasan.h:402 [inline]
 lock_acquire kernel/locking/lockdep.c:5842 [inline]
 lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
 unset_event drivers/usb/usbip/usbip_event.c:35 [inline]
 event_handler+0x21e/0x570 drivers/usb/usbip/usbip_event.c:80
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 13421:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x322/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 __usb_create_hcd+0x5e/0xac0 drivers/usb/core/hcd.c:2566
 vhci_hcd_probe+0xf3/0x4e0 drivers/usb/usbip/vhci_hcd.c:1378
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 13423:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6692
 hcd_release drivers/usb/core/hcd.c:2690 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_put_hcd drivers/usb/core/hcd.c:2704 [inline]
 usb_put_hcd+0x149/0x1f0 drivers/usb/core/hcd.c:2701
 vhci_hcd_remove+0x107/0x1b0 drivers/usb/usbip/vhci_hcd.c:1434
 platform_remove+0x5f/0x80 drivers/base/platform.c:1456
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 insert_work+0x36/0x230 kernel/workqueue.c:2226
 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401
 queue_work_on+0x1a9/0x1e0 kernel/workqueue.c:2452
 queue_work include/linux/workqueue.h:699 [inline]
 usb_hcd_giveback_urb+0x330/0x4a0 drivers/usb/core/hcd.c:1758
 usb_rh_urb_dequeue drivers/usb/core/hcd.c:845 [inline]
 unlink1+0x418/0x510 drivers/usb/core/hcd.c:1580
 usb_hcd_unlink_urb+0x131/0x210 drivers/usb/core/hcd.c:1617
 usb_kill_urb drivers/usb/core/urb.c:716 [inline]
 usb_kill_urb+0x121/0x320 drivers/usb/core/urb.c:703
 hub_quiesce+0x1e9/0x320 drivers/usb/core/hub.c:1412
 hub_suspend+0x4ab/0x9e0 drivers/usb/core/hub.c:4008
 usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
 usb_suspend_both+0x288/0x950 drivers/usb/core/driver.c:1446
 usb_runtime_suspend+0x49/0x120 drivers/usb/core/driver.c:2000
 __rpm_callback+0xc8/0x620 drivers/base/power/runtime.c:406
 rpm_callback+0x16a/0x1b0 drivers/base/power/runtime.c:460
 rpm_suspend+0x2f4/0x11a0 drivers/base/power/runtime.c:698
 __pm_runtime_suspend+0xba/0x1a0 drivers/base/power/runtime.c:1167
 pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:740 [inline]
 usb_new_device.cold+0xd61/0x115c drivers/usb/core/hub.c:2727
 register_root_hub+0x4e6/0x639 drivers/usb/core/hcd.c:990
 usb_add_hcd.cold+0xccd/0x1158 drivers/usb/core/hcd.c:2987
 vhci_hcd_probe+0x14b/0x4e0 drivers/usb/usbip/vhci_hcd.c:1388
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Second to last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 insert_work+0x36/0x230 kernel/workqueue.c:2226
 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401
 queue_work_on+0x1a9/0x1e0 kernel/workqueue.c:2452
 queue_work include/linux/workqueue.h:699 [inline]
 usb_hcd_giveback_urb+0x3b8/0x4a0 drivers/usb/core/hcd.c:1760
 rh_call_control drivers/usb/core/hcd.c:706 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
 usb_hcd_submit_urb+0xab7/0x2150 drivers/usb/core/hcd.c:1538
 usb_submit_urb+0x827/0x19b0 drivers/usb/core/urb.c:586
 usb_start_wait_urb+0x10e/0x580 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x328/0x4b0 drivers/usb/core/message.c:167
 get_port_status drivers/usb/core/hub.c:607 [inline]
 hub_ext_port_status+0x152/0x600 drivers/usb/core/hub.c:624
 usb_hub_port_status drivers/usb/core/hub.c:674 [inline]
 hub_activate+0x6e5/0x1c40 drivers/usb/core/hub.c:1185
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880551a8000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 5288 bytes inside of
 freed 8192-byte region [ffff8880551a8000, ffff8880551aa000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x551a8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13322, tgid 13320 (syz.1.2421), ts 499968291131, free_ts 263312866515
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x66d/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 __usb_create_hcd+0x5e/0xac0 drivers/usb/core/hcd.c:2566
 vhci_hcd_probe+0x1a5/0x4e0 drivers/usb/usbip/vhci_hcd.c:1394
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
page last free pid 37 tgid 37 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x26b/0x6a0 mm/slub.c:4931
 alloc_filename fs/namei.c:147 [inline]
 do_getname_kernel+0x5d/0x250 fs/namei.c:266
 getname_kernel fs/namei.c:289 [inline]
 class_filename_kernel_constructor include/linux/fs.h:2565 [inline]
 start_removing_path+0x8a/0x350 fs/namei.c:2964
 handle_remove drivers/base/devtmpfs.c:325 [inline]
 handle drivers/base/devtmpfs.c:386 [inline]
 devtmpfs_work_loop+0x5c4/0xae4 drivers/base/devtmpfs.c:399
 devtmpfsd+0x3f/0x50 drivers/base/devtmpfs.c:441
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff8880551a9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880551a9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880551a9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff8880551a9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880551a9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
vhci_hcd vhci_hcd.0: disconnect device
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
Read of size 1 at addr ffff8880551a94a8 by task kworker/u32:2/5599

CPU: 2 UID: 0 PID: 5599 Comm: kworker/u32:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usbip_event event_handler
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 __kasan_check_byte+0x36/0x50 mm/kasan/common.c:574
 kasan_check_byte include/linux/kasan.h:402 [inline]
 lock_acquire kernel/locking/lockdep.c:5842 [inline]
 lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
 unset_event drivers/usb/usbip/usbip_event.c:35 [inline]
 event_handler+0x21e/0x570 drivers/usb/usbip/usbip_event.c:80
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 13421:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x322/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 __usb_create_hcd+0x5e/0xac0 drivers/usb/core/hcd.c:2566
 vhci_hcd_probe+0xf3/0x4e0 drivers/usb/usbip/vhci_hcd.c:1378
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 13423:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6692
 hcd_release drivers/usb/core/hcd.c:2690 [inline]
 kref_put include/linux/kref.h:65 [inline]
 usb_put_hcd drivers/usb/core/hcd.c:2704 [inline]
 usb_put_hcd+0x149/0x1f0 drivers/usb/core/hcd.c:2701
 vhci_hcd_remove+0x107/0x1b0 drivers/usb/usbip/vhci_hcd.c:1434
 platform_remove+0x5f/0x80 drivers/base/platform.c:1456
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 insert_work+0x36/0x230 kernel/workqueue.c:2226
 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401
 queue_work_on+0x1a9/0x1e0 kernel/workqueue.c:2452
 queue_work include/linux/workqueue.h:699 [inline]
 usb_hcd_giveback_urb+0x330/0x4a0 drivers/usb/core/hcd.c:1758
 usb_rh_urb_dequeue drivers/usb/core/hcd.c:845 [inline]
 unlink1+0x418/0x510 drivers/usb/core/hcd.c:1580
 usb_hcd_unlink_urb+0x131/0x210 drivers/usb/core/hcd.c:1617
 usb_kill_urb drivers/usb/core/urb.c:716 [inline]
 usb_kill_urb+0x121/0x320 drivers/usb/core/urb.c:703
 hub_quiesce+0x1e9/0x320 drivers/usb/core/hub.c:1412
 hub_suspend+0x4ab/0x9e0 drivers/usb/core/hub.c:4008
 usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
 usb_suspend_both+0x288/0x950 drivers/usb/core/driver.c:1446
 usb_runtime_suspend+0x49/0x120 drivers/usb/core/driver.c:2000
 __rpm_callback+0xc8/0x620 drivers/base/power/runtime.c:406
 rpm_callback+0x16a/0x1b0 drivers/base/power/runtime.c:460
 rpm_suspend+0x2f4/0x11a0 drivers/base/power/runtime.c:698
 __pm_runtime_suspend+0xba/0x1a0 drivers/base/power/runtime.c:1167
 pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:740 [inline]
 usb_new_device.cold+0xd61/0x115c drivers/usb/core/hub.c:2727
 register_root_hub+0x4e6/0x639 drivers/usb/core/hcd.c:990
 usb_add_hcd.cold+0xccd/0x1158 drivers/usb/core/hcd.c:2987
 vhci_hcd_probe+0x14b/0x4e0 drivers/usb/usbip/vhci_hcd.c:1388
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Second to last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 insert_work+0x36/0x230 kernel/workqueue.c:2226
 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401
 queue_work_on+0x1a9/0x1e0 kernel/workqueue.c:2452
 queue_work include/linux/workqueue.h:699 [inline]
 usb_hcd_giveback_urb+0x3b8/0x4a0 drivers/usb/core/hcd.c:1760
 rh_call_control drivers/usb/core/hcd.c:706 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
 usb_hcd_submit_urb+0xab7/0x2150 drivers/usb/core/hcd.c:1538
 usb_submit_urb+0x827/0x19b0 drivers/usb/core/urb.c:586
 usb_start_wait_urb+0x10e/0x580 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x328/0x4b0 drivers/usb/core/message.c:167
 get_port_status drivers/usb/core/hub.c:607 [inline]
 hub_ext_port_status+0x152/0x600 drivers/usb/core/hub.c:624
 usb_hub_port_status drivers/usb/core/hub.c:674 [inline]
 hub_activate+0x6e5/0x1c40 drivers/usb/core/hub.c:1185
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880551a8000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 5288 bytes inside of
 freed 8192-byte region [ffff8880551a8000, ffff8880551aa000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x551a8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13322, tgid 13320 (syz.1.2421), ts 499968291131, free_ts 263312866515
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab mm/slub.c:3380 [inline]
 new_slab+0xa2/0x640 mm/slub.c:3426
 refill_objects+0xe3/0x410 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x66d/0x820 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 __usb_create_hcd+0x5e/0xac0 drivers/usb/core/hcd.c:2566
 vhci_hcd_probe+0x1a5/0x4e0 drivers/usb/usbip/vhci_hcd.c:1394
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
 device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
 bind_store+0xf4/0x190 drivers/base/bus.c:267
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
page last free pid 37 tgid 37 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x26b/0x6a0 mm/slub.c:4931
 alloc_filename fs/namei.c:147 [inline]
 do_getname_kernel+0x5d/0x250 fs/namei.c:266
 getname_kernel fs/namei.c:289 [inline]
 class_filename_kernel_constructor include/linux/fs.h:2565 [inline]
 start_removing_path+0x8a/0x350 fs/namei.c:2964
 handle_remove drivers/base/devtmpfs.c:325 [inline]
 handle drivers/base/devtmpfs.c:386 [inline]
 devtmpfs_work_loop+0x5c4/0xae4 drivers/base/devtmpfs.c:399
 devtmpfsd+0x3f/0x50 drivers/base/devtmpfs.c:441
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff8880551a9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880551a9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880551a9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff8880551a9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880551a9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================