at$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2759.368766] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2759.379764] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2759.391838] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2759.403020] ubi0: background thread "ubi_bgt0d" started, PID 29986
[ 2759.411181] ubi: mtd0 is already attached to ubi0
09:29:51 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {r3}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:29:52 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:52 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2759.416294] ubi: mtd0 is already attached to ubi0
[ 2759.422837] ubi0: detaching mtd0
[ 2759.434097] ubi0: mtd0 is detached
[ 2759.438466] ubi0: attaching mtd0
[ 2759.448921] ubi0: scanning is finished
[ 2759.583341] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2759.591077] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2759.597662] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2759.604255] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2759.611451] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2759.617700] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:52 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, 0x0)
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2759.625533] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2759.635484] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2759.645022] ubi0: background thread "ubi_bgt0d" started, PID 30009
[ 2759.650465] ubi: mtd0 is already attached to ubi0
[ 2759.656475] ubi: mtd0 is already attached to ubi0
[ 2759.669336] ubi0: detaching mtd0
[ 2759.674122] ubi0: mtd0 is detached
[ 2759.677995] ubi0: attaching mtd0
09:29:52 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:52 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2759.700079] ubi0: scanning is finished
[ 2759.821877] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2759.829018] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2759.837385] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2759.844809] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2759.855042] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2759.862119] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2759.870701] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2759.880939] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2759.891751] ubi0: background thread "ubi_bgt0d" started, PID 30029
[ 2759.891871] ubi: mtd0 is already attached to ubi0
[ 2759.905578] ubi: mtd0 is already attached to ubi0
[ 2759.913791] ubi: mtd0 is already attached to ubi0
[ 2759.918698] ubi0: detaching mtd0
09:29:52 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {r3}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:29:52 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:52 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:52 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2759.923782] ubi0: mtd0 is detached
[ 2759.928008] ubi0: attaching mtd0
[ 2759.994753] ubi0: scanning is finished
[ 2760.096949] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2760.107682] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2760.114717] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2760.121506] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2760.128374] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2760.134728] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:52 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2760.142304] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2760.152240] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2760.162128] ubi: mtd0 is already attached to ubi0
[ 2760.162812] ubi0: background thread "ubi_bgt0d" started, PID 30051
[ 2760.167118] ubi: mtd0 is already attached to ubi0
[ 2760.179649] ubi0: detaching mtd0
[ 2760.188367] ubi0: mtd0 is detached
[ 2760.192961] ubi0: attaching mtd0
09:29:52 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:52 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2760.220994] ubi0: scanning is finished
[ 2760.343811] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2760.350995] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2760.357748] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2760.365251] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2760.372722] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2760.378860] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2760.387150] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2760.397756] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2760.407915] ubi0: background thread "ubi_bgt0d" started, PID 30071
[ 2760.409966] ubi: mtd0 is already attached to ubi0
[ 2760.420737] ubi: mtd0 is already attached to ubi0
[ 2760.426776] ubi0: detaching mtd0
[ 2760.433579] ubi0: mtd0 is detached
[ 2760.438247] ubi0: attaching mtd0
09:29:53 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {r2}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:29:53 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2760.450358] ubi0: scanning is finished
09:29:53 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2760.579071] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2760.590424] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2760.597045] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2760.605189] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2760.612861] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2760.619019] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:53 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2760.628242] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2760.638269] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2760.648305] ubi0: background thread "ubi_bgt0d" started, PID 30087
[ 2760.648384] ubi: mtd0 is already attached to ubi0
[ 2760.662263] ubi: mtd0 is already attached to ubi0
[ 2760.667308] ubi0: detaching mtd0
[ 2760.677770] ubi0: mtd0 is detached
09:29:53 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:53 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2760.689701] ubi0: attaching mtd0
[ 2760.705340] ubi0: scanning is finished
[ 2760.836215] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2760.843745] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2760.850785] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2760.857161] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2760.865013] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2760.872025] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2760.879744] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2760.889081] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2760.899469] ubi: mtd0 is already attached to ubi0
[ 2760.902646] ubi0: background thread "ubi_bgt0d" started, PID 30109
[ 2760.904539] ubi: mtd0 is already attached to ubi0
[ 2760.917899] ubi0: detaching mtd0
[ 2760.927443] ubi0: mtd0 is detached
09:29:53 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:53 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {r2}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2760.937395] ubi0: attaching mtd0
[ 2760.947713] ubi0: scanning is finished
09:29:53 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2761.063991] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2761.071023] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2761.077621] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2761.084355] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2761.091846] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2761.098008] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:53 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2761.106313] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2761.116073] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2761.126182] ubi0: background thread "ubi_bgt0d" started, PID 30123
[ 2761.129900] ubi: mtd0 is already attached to ubi0
[ 2761.137609] ubi: mtd0 is already attached to ubi0
[ 2761.149416] ubi0: detaching mtd0
09:29:53 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:53 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2761.161934] ubi0: mtd0 is detached
[ 2761.171005] ubi0: attaching mtd0
[ 2761.179567] ubi0: scanning is finished
[ 2761.334231] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2761.341610] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2761.348258] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2761.356176] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2761.364122] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2761.371431] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2761.379071] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2761.389943] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2761.400335] ubi0: background thread "ubi_bgt0d" started, PID 30145
[ 2761.406793] ubi: mtd0 is already attached to ubi0
[ 2761.413440] ubi: mtd0 is already attached to ubi0
[ 2761.419039] ubi0: detaching mtd0
[ 2761.427274] ubi0: mtd0 is detached
09:29:53 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {r2}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:29:54 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2761.433176] ubi0: attaching mtd0
[ 2761.444847] ubi0: scanning is finished
09:29:54 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2761.569849] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2761.577659] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2761.588871] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2761.596519] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2761.606836] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2761.614232] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2761.623310] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2761.633993] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2761.644041] ubi0: background thread "ubi_bgt0d" started, PID 30159
[ 2761.653167] ubi0: detaching mtd0
[ 2761.662458] ubi0: mtd0 is detached
09:29:54 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2761.673106] ubi0: attaching mtd0
[ 2761.695026] ubi0: scanning is finished
[ 2761.776648] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2761.783785] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2761.793729] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2761.800734] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2761.807584] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2761.817888] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2761.826063] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2761.838738] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2761.848796] ubi0: background thread "ubi_bgt0d" started, PID 30172
[ 2761.848903] ubi: mtd0 is already attached to ubi0
[ 2761.866304] ubi0: detaching mtd0
[ 2761.871785] ubi0: mtd0 is detached
09:29:54 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2761.875973] ubi0: attaching mtd0
[ 2761.890399] ubi0: scanning is finished
09:29:54 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2762.094826] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2762.102363] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2762.109991] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2762.116340] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2762.124373] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2762.132292] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2762.141226] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2762.151283] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2762.162077] ubi0: background thread "ubi_bgt0d" started, PID 30184
[ 2762.168588] ubi: mtd0 is already attached to ubi0
[ 2762.174511] ubi: mtd0 is already attached to ubi0
[ 2762.180843] ubi0: detaching mtd0
[ 2762.186040] ubi0: mtd0 is detached
[ 2762.190889] ubi0: attaching mtd0
09:29:54 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2762.204954] ubi0: scanning is finished
09:29:54 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:54 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2762.348794] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2762.358702] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2762.365681] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2762.372329] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2762.381186] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2762.387359] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:54 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2762.395087] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2762.404937] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2762.415377] ubi0: background thread "ubi_bgt0d" started, PID 30202
[ 2762.421899] ubi0: detaching mtd0
[ 2762.439193] ubi0: mtd0 is detached
[ 2762.444409] ubi0: attaching mtd0
[ 2762.455634] ubi0: scanning is finished
[ 2762.543282] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2762.551432] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2762.558325] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2762.566810] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2762.574853] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2762.582127] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2762.590534] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2762.601027] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2762.612058] ubi0: background thread "ubi_bgt0d" started, PID 30214
[ 2762.612180] ubi: mtd0 is already attached to ubi0
[ 2762.624555] ubi0: detaching mtd0
[ 2762.632871] ubi0: mtd0 is detached
[ 2762.638481] ubi0: attaching mtd0
09:29:55 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2762.655895] ubi0: scanning is finished
09:29:55 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2762.782000] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2762.789991] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2762.796693] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2762.804176] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2762.811846] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2762.817994] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2762.826535] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2762.836812] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2762.847161] ubi0: background thread "ubi_bgt0d" started, PID 30229
[ 2762.853876] ubi: mtd0 is already attached to ubi0
[ 2762.859780] ubi: mtd0 is already attached to ubi0
[ 2762.865329] ubi0: detaching mtd0
[ 2762.874325] ubi0: mtd0 is detached
09:29:55 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:55 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:29:55 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2762.881065] ubi0: attaching mtd0
[ 2762.892619] ubi0: scanning is finished
[ 2763.022586] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2763.032200] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2763.041739] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2763.048365] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2763.056656] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2763.063574] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2763.072366] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2763.082601] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2763.094693] ubi0: background thread "ubi_bgt0d" started, PID 30243
[ 2763.094984] ubi: mtd0 is already attached to ubi0
[ 2763.112000] ubi: mtd0 is already attached to ubi0
[ 2763.116969] ubi0: detaching mtd0
09:29:55 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:29:55 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:55 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2763.128082] ubi0: mtd0 is detached
[ 2763.135779] ubi0: attaching mtd0
[ 2763.151084] ubi0: scanning is finished
[ 2763.283032] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2763.290093] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2763.296668] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2763.303359] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2763.310734] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2763.316883] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:55 executing program 1:
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2763.325752] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2763.335064] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2763.344569] ubi0: background thread "ubi_bgt0d" started, PID 30265
[ 2763.344781] ubi0: detaching mtd0
[ 2763.363424] ubi0: mtd0 is detached
[ 2763.369766] ubi0: attaching mtd0
[ 2763.392847] ubi0: scanning is finished
[ 2763.474442] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2763.481565] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2763.488140] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2763.495670] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2763.503037] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2763.510952] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:56 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2763.518329] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2763.529134] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2763.538537] ubi0: background thread "ubi_bgt0d" started, PID 30273
[ 2763.538861] ubi: mtd0 is already attached to ubi0
[ 2763.551658] ubi0: detaching mtd0
[ 2763.561936] ubi0: mtd0 is detached
[ 2763.568114] ubi0: attaching mtd0
09:29:56 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2763.596847] ubi0: scanning is finished
[ 2763.719455] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2763.726536] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2763.733957] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2763.740857] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2763.747886] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2763.754792] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:56 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2763.762387] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2763.772152] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2763.782123] ubi0: background thread "ubi_bgt0d" started, PID 30288
[ 2763.788563] ubi: mtd0 is already attached to ubi0
[ 2763.794318] ubi: mtd0 is already attached to ubi0
[ 2763.800279] ubi: mtd0 is already attached to ubi0
[ 2763.805424] ubi0: detaching mtd0
09:29:56 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:29:56 executing program 1:
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:29:56 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2763.823027] ubi0: mtd0 is detached
[ 2763.827072] ubi0: attaching mtd0
[ 2763.846950] ubi0: scanning is finished
[ 2763.970269] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2763.978063] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2763.985696] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2763.993176] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2764.000795] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2764.006976] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2764.014939] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2764.024698] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2764.034652] ubi0: background thread "ubi_bgt0d" started, PID 30308
[ 2764.041323] ubi0: detaching mtd0
[ 2764.047932] ubi0: mtd0 is detached
[ 2764.055480] ubi0: attaching mtd0
09:29:56 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2764.073592] ubi0: scanning is finished
[ 2764.186240] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2764.193609] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2764.201167] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2764.207460] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2764.216478] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2764.223859] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2764.232070] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2764.242543] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2764.252908] ubi0: background thread "ubi_bgt0d" started, PID 30320
[ 2764.260261] ubi0: detaching mtd0
[ 2764.265497] ubi0: mtd0 is detached
[ 2764.270678] ubi0: attaching mtd0
[ 2764.281227] ubi0: scanning is finished
09:29:56 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2764.361727] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2764.369981] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2764.376818] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2764.383587] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2764.390667] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2764.396978] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:56 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2764.405926] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2764.415529] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2764.425108] ubi0: background thread "ubi_bgt0d" started, PID 30327
[ 2764.431850] ubi: mtd0 is already attached to ubi0
[ 2764.436857] ubi: mtd0 is already attached to ubi0
[ 2764.453713] ubi: mtd0 is already attached to ubi0
[ 2764.458702] ubi0: detaching mtd0
09:29:57 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2764.469538] ubi0: mtd0 is detached
[ 2764.475197] ubi0: attaching mtd0
09:29:57 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:57 executing program 1:
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2764.512428] ubi0: scanning is finished
[ 2764.623308] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2764.630741] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2764.637456] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2764.648424] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2764.656511] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2764.666438] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2764.674610] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2764.687155] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2764.697570] ubi0: background thread "ubi_bgt0d" started, PID 30351
[ 2764.704552] ubi0: detaching mtd0
[ 2764.710567] ubi0: mtd0 is detached
[ 2764.714648] ubi0: attaching mtd0
09:29:57 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2764.736233] ubi0: scanning is finished
[ 2764.848231] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2764.855773] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2764.862909] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2764.870073] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2764.877104] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2764.885147] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:57 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:29:57 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2764.893158] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2764.902775] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2764.913067] ubi: mtd0 is already attached to ubi0
[ 2764.918100] ubi0: detaching mtd0
[ 2764.921666] ubi0: background thread "ubi_bgt0d" started, PID 30363
[ 2764.932539] ubi0: mtd0 is detached
[ 2764.943728] ubi0: attaching mtd0
[ 2764.981190] ubi0: scanning is finished
[ 2765.061953] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2765.068889] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2765.075458] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2765.083282] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2765.090928] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2765.097116] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:57 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2765.105530] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2765.115704] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2765.126215] ubi0: background thread "ubi_bgt0d" started, PID 30376
[ 2765.126473] ubi: mtd0 is already attached to ubi0
[ 2765.140012] ubi: mtd0 is already attached to ubi0
[ 2765.145474] ubi0: detaching mtd0
[ 2765.156540] ubi0: mtd0 is detached
09:29:57 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2765.166230] ubi0: attaching mtd0
09:29:57 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2765.195084] ubi0: scanning is finished
[ 2765.303880] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2765.311131] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2765.317702] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2765.325526] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2765.333115] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2765.341352] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2765.348714] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2765.359069] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2765.368485] ubi0: background thread "ubi_bgt0d" started, PID 30395
[ 2765.368760] ubi0: detaching mtd0
[ 2765.385687] ubi0: mtd0 is detached
[ 2765.390080] ubi0: attaching mtd0
09:29:57 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2765.403985] ubi0: scanning is finished
[ 2765.512880] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2765.521710] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2765.530006] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2765.536348] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2765.544415] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2765.551183] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:58 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2765.558531] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2765.569574] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2765.579827] ubi0: background thread "ubi_bgt0d" started, PID 30406
[ 2765.586598] ubi: mtd0 is already attached to ubi0
[ 2765.592909] ubi: mtd0 is already attached to ubi0
09:29:58 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2765.610450] ubi0: detaching mtd0
[ 2765.617473] ubi0: mtd0 is detached
[ 2765.625705] ubi0: attaching mtd0
09:29:58 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2765.656140] ubi0: scanning is finished
[ 2765.749062] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2765.755949] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2765.764756] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2765.772069] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2765.780797] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2765.786947] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2765.795631] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2765.805710] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2765.816256] ubi0: background thread "ubi_bgt0d" started, PID 30421
[ 2765.819658] ubi: mtd0 is already attached to ubi0
[ 2765.827634] ubi0: detaching mtd0
[ 2765.836351] ubi0: mtd0 is detached
09:29:58 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:29:58 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2765.847608] ubi0: attaching mtd0
[ 2765.883765] ubi0: scanning is finished
[ 2765.974140] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2765.981572] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2765.988272] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2765.995098] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.002152] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2766.008355] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:58 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2766.015956] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2766.025399] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2766.035009] ubi0: background thread "ubi_bgt0d" started, PID 30437
[ 2766.039902] ubi0: detaching mtd0
[ 2766.049642] ubi0: mtd0 is detached
[ 2766.058379] ubi0: attaching mtd0
[ 2766.067729] ubi0: scanning is finished
[ 2766.165414] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2766.175269] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2766.183814] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2766.192536] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.200668] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2766.206900] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:58 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2766.215273] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2766.225300] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2766.235770] ubi0: background thread "ubi_bgt0d" started, PID 30447
[ 2766.235938] ubi: mtd0 is already attached to ubi0
[ 2766.249390] ubi0: detaching mtd0
09:29:58 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2766.270460] ubi0: mtd0 is detached
[ 2766.280515] ubi0: attaching mtd0
[ 2766.307157] ubi0: scanning is finished
[ 2766.390878] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2766.397897] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2766.407924] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2766.415152] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.425414] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2766.432370] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2766.442675] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2766.457725] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2766.467421] ubi0: detaching mtd0
[ 2766.471074] ubi0: background thread "ubi_bgt0d" started, PID 30460
[ 2766.479549] ubi0: mtd0 is detached
[ 2766.485876] ubi0: attaching mtd0
09:29:59 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)

[ 2766.501809] ubi0: scanning is finished
[ 2766.580540] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2766.587495] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2766.594358] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2766.600953] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.607703] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2766.614664] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:59 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2766.622785] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2766.632841] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2766.643030] ubi0: background thread "ubi_bgt0d" started, PID 30469
[ 2766.649727] ubi: mtd0 is already attached to ubi0
[ 2766.654942] ubi0: detaching mtd0
[ 2766.666996] ubi0: mtd0 is detached
[ 2766.682084] ubi0: attaching mtd0
09:29:59 executing program 2:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2766.703855] ubi0: scanning is finished
[ 2766.799505] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2766.806770] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2766.817490] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2766.824948] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.835538] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2766.842598] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2766.855493] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2766.865454] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2766.878273] ubi0: background thread "ubi_bgt0d" started, PID 30484
[ 2766.884863] ubi0: detaching mtd0
[ 2766.893346] ubi0: mtd0 is detached
[ 2766.897051] ubi0: attaching mtd0
09:29:59 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2766.903471] ubi0: scanning is finished
[ 2766.964368] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2766.972089] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2766.979079] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2766.986100] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2766.993249] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2767.000271] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2767.008669] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2767.018093] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2767.027774] ubi0: background thread "ubi_bgt0d" started, PID 30493
[ 2767.034447] ubi: mtd0 is already attached to ubi0
[ 2767.042495] ubi0: detaching mtd0
09:29:59 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:29:59 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2767.064493] ubi0: mtd0 is detached
[ 2767.072989] ubi0: attaching mtd0
[ 2767.105252] ubi0: scanning is finished
[ 2767.184005] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2767.190993] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2767.197621] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2767.204617] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2767.213195] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2767.220353] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2767.227712] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2767.237958] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2767.248112] ubi0: background thread "ubi_bgt0d" started, PID 30508
[ 2767.248185] ubi0: detaching mtd0
[ 2767.261278] ubi0: mtd0 is detached
[ 2767.265449] ubi0: attaching mtd0
[ 2767.280805] ubi0: scanning is finished
09:29:59 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))

[ 2767.368502] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2767.375511] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2767.383048] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2767.390019] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2767.396834] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2767.404021] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:29:59 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2767.412515] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2767.422589] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2767.432776] ubi0: background thread "ubi_bgt0d" started, PID 30517
[ 2767.432881] ubi: mtd0 is already attached to ubi0
[ 2767.444962] ubi0: detaching mtd0
[ 2767.456666] ubi0: mtd0 is detached
[ 2767.472165] ubi0: attaching mtd0
09:30:00 executing program 2:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2767.503446] ubi0: scanning is finished
[ 2767.604511] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2767.611691] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2767.618221] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2767.625887] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2767.633719] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2767.641354] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2767.650376] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2767.660735] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2767.671222] ubi0: background thread "ubi_bgt0d" started, PID 30533
[ 2767.671299] ubi0: detaching mtd0
[ 2767.686862] ubi0: mtd0 is detached
[ 2767.692867] ubi0: attaching mtd0
[ 2767.699641] ubi0: scanning is finished
09:30:00 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2767.774480] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2767.790385] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2767.797043] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2767.806757] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2767.815236] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:00 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2767.825600] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2767.833600] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2767.845888] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2767.855742] ubi0: background thread "ubi_bgt0d" started, PID 30543
[ 2767.862314] ubi: mtd0 is already attached to ubi0
[ 2767.867292] ubi0: detaching mtd0
09:30:00 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2767.894511] ubi0: mtd0 is detached
[ 2767.899707] ubi0: attaching mtd0
[ 2767.923551] ubi0: scanning is finished
[ 2768.001834] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2768.009123] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2768.015772] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2768.023772] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2768.031447] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2768.037678] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:00 executing program 3:
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2768.046229] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2768.056522] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2768.066889] ubi0: background thread "ubi_bgt0d" started, PID 30556
[ 2768.073949] ubi: mtd0 is already attached to ubi0
[ 2768.081891] ubi0: detaching mtd0
09:30:00 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)

[ 2768.102327] ubi0: mtd0 is detached
[ 2768.107991] ubi0: attaching mtd0
[ 2768.135462] ubi0: scanning is finished
[ 2768.218737] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2768.225684] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2768.233598] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2768.240695] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2768.247679] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2768.255040] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2768.263710] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2768.274151] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2768.284160] ubi0: background thread "ubi_bgt0d" started, PID 30568
[ 2768.284219] ubi0: detaching mtd0
[ 2768.297929] ubi0: mtd0 is detached
[ 2768.304358] ubi0: attaching mtd0
09:30:00 executing program 2:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2768.317331] ubi0: scanning is finished
[ 2768.405406] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2768.413155] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2768.420648] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2768.427114] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2768.434490] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2768.442075] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:01 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2768.449871] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2768.459469] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2768.469170] ubi0: background thread "ubi_bgt0d" started, PID 30578
[ 2768.475646] ubi: mtd0 is already attached to ubi0
[ 2768.480729] ubi0: detaching mtd0
[ 2768.490875] ubi0: mtd0 is detached
[ 2768.494773] ubi0: attaching mtd0
09:30:01 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2768.516325] ubi0: scanning is finished
[ 2768.640019] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2768.646893] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2768.654924] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2768.661993] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2768.669687] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2768.675825] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:01 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2768.684210] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2768.694547] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2768.704596] ubi0: background thread "ubi_bgt0d" started, PID 30593
[ 2768.709483] ubi: mtd0 is already attached to ubi0
[ 2768.716416] ubi0: detaching mtd0
[ 2768.729083] ubi0: mtd0 is detached
[ 2768.733429] ubi0: attaching mtd0
09:30:01 executing program 3:
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2768.756845] ubi0: scanning is finished
[ 2768.872981] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2768.880216] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2768.886997] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2768.897460] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2768.905639] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2768.915644] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2768.923727] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2768.933873] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2768.944269] ubi0: background thread "ubi_bgt0d" started, PID 30609
[ 2768.944319] ubi0: detaching mtd0
[ 2768.958075] ubi0: mtd0 is detached
[ 2768.962640] ubi0: attaching mtd0
[ 2768.977129] ubi0: scanning is finished
09:30:01 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2769.051280] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2769.058101] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2769.065713] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2769.073338] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2769.081676] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2769.087955] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:01 executing program 2:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2769.096609] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2769.106825] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2769.116897] ubi0: background thread "ubi_bgt0d" started, PID 30616
[ 2769.125398] ubi0: detaching mtd0
[ 2769.130647] ubi0: mtd0 is detached
[ 2769.134323] ubi0: attaching mtd0
[ 2769.141132] ubi0: scanning is finished
[ 2769.202582] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2769.209621] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2769.216217] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2769.225956] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2769.232867] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2769.241978] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:01 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2769.251270] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2769.263533] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2769.273376] ubi0: background thread "ubi_bgt0d" started, PID 30625
[ 2769.280263] ubi: mtd0 is already attached to ubi0
[ 2769.285370] ubi0: detaching mtd0
[ 2769.292046] ubi0: mtd0 is detached
[ 2769.297607] ubi0: attaching mtd0
09:30:01 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2769.323496] ubi0: scanning is finished
[ 2769.442708] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2769.452931] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2769.460884] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2769.467447] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2769.478165] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2769.484515] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2769.494786] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2769.504464] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2769.516492] ubi0: background thread "ubi_bgt0d" started, PID 30640
[ 2769.516613] ubi: mtd0 is already attached to ubi0
[ 2769.529292] ubi0: detaching mtd0
09:30:02 executing program 5:
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x400000, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:02 executing program 3:
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2769.542880] ubi0: mtd0 is detached
[ 2769.547488] ubi0: attaching mtd0
[ 2769.577843] ubi0: scanning is finished
[ 2769.693366] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2769.700761] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2769.707510] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2769.715063] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2769.723125] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2769.730279] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2769.737648] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2769.747702] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2769.757658] ubi0: background thread "ubi_bgt0d" started, PID 30657
[ 2769.757707] ubi0: detaching mtd0
[ 2769.772036] ubi0: mtd0 is detached
[ 2769.775899] ubi0: attaching mtd0
[ 2769.793718] ubi0: scanning is finished
09:30:02 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)

[ 2769.869933] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2769.876836] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2769.886245] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2769.893443] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2769.901018] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2769.907325] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2769.915574] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2769.925642] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2769.935527] ubi0: background thread "ubi_bgt0d" started, PID 30664
[ 2769.935667] ubi: mtd0 is already attached to ubi0
[ 2769.947796] ubi0: detaching mtd0
[ 2769.956658] ubi0: mtd0 is detached
[ 2769.963202] ubi0: attaching mtd0
09:30:02 executing program 2:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:02 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2769.978080] ubi0: scanning is finished
[ 2770.079461] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2770.086408] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2770.094151] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2770.101104] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2770.107865] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2770.115523] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2770.123933] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2770.134699] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2770.144949] ubi0: background thread "ubi_bgt0d" started, PID 30676
[ 2770.145080] ubi0: detaching mtd0
[ 2770.161449] ubi0: mtd0 is detached
[ 2770.165495] ubi0: attaching mtd0
09:30:02 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2770.177145] ubi0: scanning is finished
[ 2770.268899] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2770.275915] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2770.283028] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2770.290728] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2770.299799] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2770.306936] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2770.314604] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2770.324145] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2770.334084] ubi0: background thread "ubi_bgt0d" started, PID 30687
[ 2770.338261] ubi: mtd0 is already attached to ubi0
[ 2770.347174] ubi0: detaching mtd0
09:30:02 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:02 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2770.370036] ubi0: mtd0 is detached
[ 2770.376373] ubi0: attaching mtd0
[ 2770.420751] ubi0: scanning is finished
[ 2770.500298] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2770.507792] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2770.515491] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2770.522516] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2770.529656] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2770.535917] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:03 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)

[ 2770.543859] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2770.553801] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2770.563475] ubi0: background thread "ubi_bgt0d" started, PID 30702
[ 2770.569146] ubi0: detaching mtd0
[ 2770.578153] ubi0: mtd0 is detached
[ 2770.586059] ubi0: attaching mtd0
[ 2770.593489] ubi0: scanning is finished
[ 2770.656765] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2770.664557] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2770.672775] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2770.680566] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2770.687381] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2770.694505] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:03 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2770.702514] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2770.713217] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2770.722968] ubi0: background thread "ubi_bgt0d" started, PID 30709
[ 2770.723026] ubi: mtd0 is already attached to ubi0
[ 2770.735304] ubi0: detaching mtd0
[ 2770.743200] ubi0: mtd0 is detached
[ 2770.749192] ubi0: attaching mtd0
09:30:03 executing program 2:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2770.773897] ubi0: scanning is finished
[ 2770.863814] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2770.871436] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2770.878341] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2770.885497] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2770.893214] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2770.899570] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2770.906979] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2770.916488] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2770.926175] ubi0: background thread "ubi_bgt0d" started, PID 30724
[ 2770.932782] ubi0: detaching mtd0
[ 2770.939472] ubi0: mtd0 is detached
[ 2770.943709] ubi0: attaching mtd0
09:30:03 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2770.962512] ubi0: scanning is finished
[ 2771.076236] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2771.083496] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2771.090426] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2771.096891] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2771.103916] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2771.110382] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:03 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2771.117824] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2771.127159] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2771.136643] ubi0: background thread "ubi_bgt0d" started, PID 30737
[ 2771.143232] ubi: mtd0 is already attached to ubi0
[ 2771.150461] ubi0: detaching mtd0
[ 2771.160214] ubi0: mtd0 is detached
[ 2771.166542] ubi0: attaching mtd0
09:30:03 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2771.191064] ubi0: scanning is finished
[ 2771.311124] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2771.318029] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2771.325355] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2771.332372] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2771.340156] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2771.346518] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:03 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2771.354455] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2771.363802] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2771.373560] ubi0: background thread "ubi_bgt0d" started, PID 30751
[ 2771.379329] ubi: mtd0 is already attached to ubi0
[ 2771.384783] ubi0: detaching mtd0
[ 2771.393581] ubi0: mtd0 is detached
[ 2771.403133] ubi0: attaching mtd0
09:30:03 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)

[ 2771.427333] ubi0: scanning is finished
[ 2771.509969] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2771.516845] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2771.523828] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2771.530235] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2771.537244] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2771.543732] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2771.551746] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2771.561781] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2771.571393] ubi0: background thread "ubi_bgt0d" started, PID 30765
[ 2771.577889] ubi0: detaching mtd0
[ 2771.586361] ubi0: mtd0 is detached
[ 2771.591577] ubi0: attaching mtd0
[ 2771.604539] ubi0: scanning is finished
09:30:04 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2771.702975] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2771.710159] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2771.716840] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2771.726995] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2771.734803] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2771.742223] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:04 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2771.750586] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2771.760712] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2771.771042] ubi: mtd0 is already attached to ubi0
[ 2771.776467] ubi0: background thread "ubi_bgt0d" started, PID 30773
[ 2771.783601] ubi0: detaching mtd0
[ 2771.793103] ubi0: mtd0 is detached
09:30:04 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2771.804689] ubi0: attaching mtd0
[ 2771.844112] ubi0: scanning is finished
[ 2771.933006] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2771.940262] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2771.946873] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2771.953350] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2771.960869] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2771.967002] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2771.974901] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2771.984577] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2771.994361] ubi0: background thread "ubi_bgt0d" started, PID 30788
[ 2772.000556] ubi: mtd0 is already attached to ubi0
[ 2772.007372] ubi0: detaching mtd0
[ 2772.020834] ubi0: mtd0 is detached
09:30:04 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:04 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2772.030981] ubi0: attaching mtd0
[ 2772.052830] ubi0: scanning is finished
[ 2772.148187] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2772.155325] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2772.162927] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2772.170191] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2772.176990] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2772.185131] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:04 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 2772.193248] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2772.203665] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2772.214100] ubi0: background thread "ubi_bgt0d" started, PID 30802
[ 2772.214357] ubi0: detaching mtd0
[ 2772.226438] ubi0: mtd0 is detached
[ 2772.231812] ubi0: attaching mtd0
[ 2772.241507] ubi0: scanning is finished
[ 2772.329781] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2772.336853] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2772.345605] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2772.352535] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2772.360613] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2772.366786] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2772.376332] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2772.386520] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2772.396396] ubi0: background thread "ubi_bgt0d" started, PID 30810
[ 2772.396715] ubi: mtd0 is already attached to ubi0
[ 2772.413219] ubi0: detaching mtd0
[ 2772.418022] ubi0: mtd0 is detached
09:30:04 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:04 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2772.433992] ubi0: attaching mtd0
[ 2772.475127] ubi0: scanning is finished
[ 2772.560506] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2772.567436] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2772.577905] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2772.584985] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2772.593022] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2772.600074] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:05 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:05 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2772.607450] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2772.617852] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2772.627870] ubi0: background thread "ubi_bgt0d" started, PID 30825
[ 2772.627992] ubi: mtd0 is already attached to ubi0
[ 2772.641789] ubi0: detaching mtd0
[ 2772.646506] ubi0: mtd0 is detached
[ 2772.657263] ubi0: attaching mtd0
[ 2772.702409] ubi0: scanning is finished
[ 2772.793857] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2772.803144] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2772.810226] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2772.816647] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2772.824123] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2772.831676] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2772.839662] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2772.849906] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2772.860059] ubi0: background thread "ubi_bgt0d" started, PID 30839
[ 2772.866606] ubi0: detaching mtd0
[ 2772.876867] ubi0: mtd0 is detached
[ 2772.883993] ubi0: attaching mtd0
09:30:05 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2772.897431] ubi0: scanning is finished
09:30:05 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2772.986265] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2772.993503] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2773.000824] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2773.007361] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2773.014971] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2773.021846] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2773.029485] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2773.038905] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2773.048252] ubi0: background thread "ubi_bgt0d" started, PID 30849
[ 2773.048454] ubi0: detaching mtd0
[ 2773.063665] ubi0: mtd0 is detached
[ 2773.067970] ubi0: attaching mtd0
09:30:05 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2773.086140] ubi0: scanning is finished
[ 2773.205137] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2773.212290] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2773.219993] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2773.226284] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2773.234475] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2773.241917] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:05 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2773.250289] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2773.260573] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2773.270859] ubi0: background thread "ubi_bgt0d" started, PID 30862
[ 2773.270956] ubi0: detaching mtd0
[ 2773.289929] ubi0: mtd0 is detached
[ 2773.293599] ubi0: attaching mtd0
[ 2773.297645] ubi0: scanning is finished
[ 2773.352783] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2773.364780] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2773.375295] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2773.382290] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2773.389640] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2773.395707] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:05 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2773.404970] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2773.414780] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2773.424637] ubi0: background thread "ubi_bgt0d" started, PID 30867
[ 2773.431783] ubi: mtd0 is already attached to ubi0
[ 2773.436786] ubi0: detaching mtd0
[ 2773.450003] ubi0: mtd0 is detached
09:30:06 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:06 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2773.458891] ubi0: attaching mtd0
[ 2773.466668] ubi0: scanning is finished
[ 2773.578856] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2773.586790] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2773.596101] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2773.603384] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2773.610888] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2773.617346] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2773.625187] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2773.635604] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2773.645594] ubi0: background thread "ubi_bgt0d" started, PID 30890
[ 2773.648395] ubi: mtd0 is already attached to ubi0
[ 2773.657397] ubi0: detaching mtd0
[ 2773.664199] ubi0: mtd0 is detached
[ 2773.668650] ubi0: attaching mtd0
09:30:06 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:06 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2773.676778] ubi0: scanning is finished
[ 2773.793585] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2773.801021] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2773.807719] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2773.815720] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2773.822721] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2773.829156] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:06 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:06 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2773.836568] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2773.846284] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2773.855855] ubi0: background thread "ubi_bgt0d" started, PID 30905
[ 2773.862526] ubi: mtd0 is already attached to ubi0
[ 2773.867833] ubi0: detaching mtd0
[ 2773.877238] ubi0: mtd0 is detached
[ 2773.888888] ubi0: attaching mtd0
[ 2773.911680] ubi0: scanning is finished
09:30:06 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2773.995638] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2774.005626] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2774.013405] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2774.020586] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2774.027333] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2774.034963] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2774.043912] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2774.053995] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2774.063973] ubi0: background thread "ubi_bgt0d" started, PID 30919
[ 2774.069012] ubi0: detaching mtd0
[ 2774.075202] ubi0: mtd0 is detached
[ 2774.080966] ubi0: attaching mtd0
[ 2774.089981] ubi0: scanning is finished
09:30:06 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2774.207795] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2774.219859] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2774.226467] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2774.236496] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2774.243985] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2774.251056] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2774.259157] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2774.271286] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2774.281500] ubi0: background thread "ubi_bgt0d" started, PID 30929
[ 2774.281706] ubi: mtd0 is already attached to ubi0
[ 2774.294229] ubi: mtd0 is already attached to ubi0
[ 2774.300793] ubi: mtd0 is already attached to ubi0
09:30:06 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:06 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:06 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2774.306758] ubi0: detaching mtd0
[ 2774.316647] ubi0: mtd0 is detached
[ 2774.324543] ubi0: attaching mtd0
09:30:06 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2774.375881] ubi0: scanning is finished
09:30:06 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:06 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

09:30:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2774.517423] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2774.524871] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2774.536363] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2774.543386] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2774.555806] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)

[ 2774.562516] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2774.574123] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2774.584067] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2774.597792] ubi0: background thread "ubi_bgt0d" started, PID 30957
[ 2774.602720] ubi: mtd0 is already attached to ubi0
[ 2774.622053] ubi: mtd0 is already attached to ubi0
09:30:07 executing program 1:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2774.645656] ubi0: detaching mtd0
[ 2774.656827] ubi0: mtd0 is detached
[ 2774.662678] ubi0: attaching mtd0
[ 2774.674789] ubi0: scanning is finished
09:30:07 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:07 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:07 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:07 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2774.818653] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2774.825671] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2774.843029] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2774.854777] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2774.861990] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2774.868482] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2774.875879] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2774.886349] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2774.896301] ubi0: background thread "ubi_bgt0d" started, PID 30985
[ 2774.896352] ubi0: detaching mtd0
[ 2774.911326] ubi0: mtd0 is detached
[ 2774.915726] ubi0: attaching mtd0
09:30:07 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2774.934930] ubi0: scanning is finished
[ 2775.030127] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2775.037068] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2775.043978] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2775.050602] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2775.057347] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2775.064763] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2775.072487] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2775.081964] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2775.091802] ubi0: background thread "ubi_bgt0d" started, PID 30996
[ 2775.098534] ubi: mtd0 is already attached to ubi0
[ 2775.103754] ubi0: detaching mtd0
[ 2775.112333] ubi0: mtd0 is detached
[ 2775.116183] ubi0: attaching mtd0
09:30:07 executing program 1:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:07 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2775.132503] ubi0: scanning is finished
09:30:07 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2775.262878] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2775.270159] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2775.276788] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2775.284610] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2775.292198] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2775.299072] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2775.306410] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2775.316783] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2775.327064] ubi0: background thread "ubi_bgt0d" started, PID 31011
[ 2775.327325] ubi0: detaching mtd0
[ 2775.340069] ubi0: mtd0 is detached
[ 2775.344061] ubi0: attaching mtd0
09:30:07 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2775.363153] ubi0: scanning is finished
[ 2775.448385] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2775.455263] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2775.463751] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2775.470792] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2775.477538] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2775.484618] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2775.493035] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2775.503284] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2775.513541] ubi0: background thread "ubi_bgt0d" started, PID 31022
[ 2775.513593] ubi0: detaching mtd0
[ 2775.526184] ubi0: mtd0 is detached
[ 2775.531298] ubi0: attaching mtd0
[ 2775.548725] ubi0: scanning is finished
09:30:08 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2775.653516] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2775.662998] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2775.672026] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2775.682602] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2775.690995] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2775.697696] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2775.707032] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2775.716908] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2775.726411] ubi0: background thread "ubi_bgt0d" started, PID 31033
[ 2775.731878] ubi: mtd0 is already attached to ubi0
[ 2775.738285] ubi0: detaching mtd0
[ 2775.743226] ubi0: mtd0 is detached
[ 2775.748022] ubi0: attaching mtd0
09:30:08 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2775.765815] ubi0: scanning is finished
09:30:08 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:08 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2775.897867] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2775.907127] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2775.914800] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2775.922072] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2775.930205] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2775.936359] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2775.944820] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2775.955618] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2775.965930] ubi0: background thread "ubi_bgt0d" started, PID 31052
[ 2775.966056] ubi0: detaching mtd0
[ 2775.988307] ubi0: mtd0 is detached
[ 2775.994908] ubi0: attaching mtd0
09:30:08 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2776.009422] ubi0: scanning is finished
[ 2776.094705] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2776.103137] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2776.111108] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2776.117452] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2776.125270] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2776.132162] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2776.140468] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2776.151051] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2776.161383] ubi0: background thread "ubi_bgt0d" started, PID 31062
[ 2776.167871] ubi0: detaching mtd0
[ 2776.173595] ubi0: mtd0 is detached
[ 2776.177443] ubi0: attaching mtd0
[ 2776.187564] ubi0: scanning is finished
09:30:08 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2776.278301] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2776.285152] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2776.293851] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2776.300423] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2776.307201] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2776.313612] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2776.322040] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2776.332097] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2776.342081] ubi0: background thread "ubi_bgt0d" started, PID 31070
[ 2776.348638] ubi: mtd0 is already attached to ubi0
[ 2776.353521] ubi0: detaching mtd0
[ 2776.364142] ubi0: mtd0 is detached
[ 2776.369120] ubi0: attaching mtd0
09:30:08 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2776.377048] ubi0: scanning is finished
09:30:08 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:08 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2776.498320] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2776.505286] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2776.513770] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2776.521060] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2776.531804] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2776.539265] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2776.547788] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2776.558354] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2776.567851] ubi0: background thread "ubi_bgt0d" started, PID 31086
[ 2776.570008] ubi0: detaching mtd0
[ 2776.585143] ubi0: mtd0 is detached
[ 2776.589410] ubi0: attaching mtd0
09:30:09 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2776.605868] ubi0: scanning is finished
[ 2776.683289] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2776.691019] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2776.697879] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2776.705117] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2776.712803] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2776.719544] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2776.727280] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2776.736942] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2776.746895] ubi0: background thread "ubi_bgt0d" started, PID 31096
[ 2776.753496] ubi0: detaching mtd0
[ 2776.762188] ubi0: mtd0 is detached
[ 2776.771100] ubi0: attaching mtd0
09:30:09 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2776.786839] ubi0: scanning is finished
[ 2776.873735] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2776.880968] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2776.887740] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2776.894739] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2776.902153] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2776.909011] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:09 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2776.916456] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2776.925898] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2776.935459] ubi0: background thread "ubi_bgt0d" started, PID 31106
[ 2776.942425] ubi0: detaching mtd0
[ 2776.953304] ubi0: mtd0 is detached
[ 2776.957183] ubi0: attaching mtd0
[ 2776.965449] ubi0: scanning is finished
[ 2777.016666] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2777.023798] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2777.030684] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2777.037084] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2777.044082] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2777.050517] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2777.057830] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
09:30:09 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2777.067168] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2777.076483] ubi0: background thread "ubi_bgt0d" started, PID 31115
[ 2777.076501] ubi0: detaching mtd0
[ 2777.094784] ubi0: mtd0 is detached
[ 2777.099190] ubi0: attaching mtd0
[ 2777.107937] ubi0: scanning is finished
09:30:09 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

[ 2777.223600] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2777.231614] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2777.239878] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2777.246393] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2777.262209] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:09 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:09 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2777.268442] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2777.275807] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2777.286804] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2777.297529] ubi0: background thread "ubi_bgt0d" started, PID 31126
[ 2777.306411] ubi0: detaching mtd0
09:30:09 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

[ 2777.324102] ubi0: mtd0 is detached
[ 2777.334070] ubi0: attaching mtd0
[ 2777.359470] ubi0: scanning is finished
09:30:09 executing program 0:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2777.461686] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2777.469229] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2777.476259] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2777.486520] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2777.494260] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2777.502200] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:10 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2777.509610] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2777.520001] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2777.529807] ubi0: background thread "ubi_bgt0d" started, PID 31145
[ 2777.537103] ubi0: detaching mtd0
[ 2777.543014] ubi0: mtd0 is detached
[ 2777.550593] ubi0: attaching mtd0
[ 2777.572394] ubi0: scanning is finished
[ 2777.657871] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2777.665225] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2777.673079] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2777.680825] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2777.687511] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2777.694505] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:10 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2777.702658] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2777.712428] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2777.723074] ubi0: background thread "ubi_bgt0d" started, PID 31155
[ 2777.729785] ubi0: detaching mtd0
[ 2777.739499] ubi0: mtd0 is detached
[ 2777.743574] ubi0: attaching mtd0
[ 2777.762601] ubi0: scanning is finished
[ 2777.841340] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2777.848694] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2777.855696] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2777.862550] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2777.869921] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2777.876174] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:10 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2777.883994] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2777.893592] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2777.903189] ubi0: background thread "ubi_bgt0d" started, PID 31164
[ 2777.909651] ubi: mtd0 is already attached to ubi0
[ 2777.914713] ubi0: detaching mtd0
[ 2777.929998] ubi0: mtd0 is detached
[ 2777.936959] ubi0: attaching mtd0
09:30:10 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2777.952757] ubi0: scanning is finished
[ 2778.062697] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2778.070266] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2778.076802] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2778.087282] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2778.094752] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2778.104139] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:10 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2778.111845] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2778.123957] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2778.134693] ubi0: background thread "ubi_bgt0d" started, PID 31179
[ 2778.142511] ubi0: detaching mtd0
[ 2778.148956] ubi0: mtd0 is detached
[ 2778.158103] ubi0: attaching mtd0
09:30:10 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2778.198316] ubi0: scanning is finished
[ 2778.291482] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2778.298948] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2778.305691] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2778.313663] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2778.321233] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2778.327486] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2778.336494] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2778.346640] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2778.357119] ubi0: background thread "ubi_bgt0d" started, PID 31194
[ 2778.365447] ubi0: detaching mtd0
[ 2778.375419] ubi0: mtd0 is detached
[ 2778.383919] ubi0: attaching mtd0
09:30:10 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2778.396200] ubi0: scanning is finished
[ 2778.491105] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2778.498923] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2778.505629] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2778.513181] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2778.520784] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2778.526969] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2778.535799] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2778.545881] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2778.556349] ubi0: background thread "ubi_bgt0d" started, PID 31202
[ 2778.558670] ubi0: detaching mtd0
[ 2778.573766] ubi0: mtd0 is detached
[ 2778.583429] ubi0: attaching mtd0
[ 2778.592654] ubi0: scanning is finished
09:30:11 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2778.693004] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2778.701155] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2778.707771] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2778.715285] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2778.722925] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2778.731254] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2778.739219] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2778.749147] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2778.760053] ubi0: background thread "ubi_bgt0d" started, PID 31210
[ 2778.760173] ubi: mtd0 is already attached to ubi0
[ 2778.772667] ubi0: detaching mtd0
[ 2778.779414] ubi0: mtd0 is detached
[ 2778.783578] ubi0: attaching mtd0
09:30:11 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:11 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2778.792650] ubi0: scanning is finished
[ 2778.917923] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2778.925129] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2778.940173] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2778.949758] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2778.956659] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:11 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2778.963172] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2778.970980] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2778.980416] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2778.990124] ubi0: background thread "ubi_bgt0d" started, PID 31226
[ 2778.991379] ubi0: detaching mtd0
09:30:11 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2779.023377] ubi0: mtd0 is detached
[ 2779.032428] ubi0: attaching mtd0
[ 2779.059530] ubi0: scanning is finished
[ 2779.137984] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2779.144867] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2779.156782] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2779.163448] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2779.171591] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2779.177779] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2779.185480] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2779.195350] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2779.205203] ubi0: detaching mtd0
[ 2779.205900] ubi0: background thread "ubi_bgt0d" started, PID 31239
[ 2779.220022] ubi0: mtd0 is detached
[ 2779.226037] ubi0: attaching mtd0
09:30:11 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2779.240502] ubi0: scanning is finished
[ 2779.341616] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2779.350204] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2779.357095] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2779.363842] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2779.371035] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2779.377330] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2779.385950] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2779.396418] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2779.406528] ubi0: background thread "ubi_bgt0d" started, PID 31248
[ 2779.413169] ubi0: detaching mtd0
[ 2779.421541] ubi0: mtd0 is detached
[ 2779.425475] ubi0: attaching mtd0
[ 2779.430437] ubi0: scanning is finished
09:30:12 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2779.487042] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2779.497550] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2779.505399] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2779.514923] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2779.521720] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2779.528307] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:12 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2779.535592] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2779.544926] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2779.554653] ubi0: background thread "ubi_bgt0d" started, PID 31254
[ 2779.561179] ubi: mtd0 is already attached to ubi0
[ 2779.568310] ubi0: detaching mtd0
[ 2779.576023] ubi0: mtd0 is detached
[ 2779.583225] ubi0: attaching mtd0
09:30:12 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:12 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2779.610802] ubi0: scanning is finished
[ 2779.728344] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2779.735230] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2779.745285] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2779.752343] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2779.762540] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2779.769535] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:12 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2779.776893] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2779.789839] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2779.799970] ubi0: detaching mtd0
[ 2779.800168] ubi0: background thread "ubi_bgt0d" started, PID 31276
[ 2779.827079] ubi0: mtd0 is detached
[ 2779.835198] ubi0: attaching mtd0
[ 2779.875785] ubi0: scanning is finished
[ 2779.945651] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2779.957120] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2779.964847] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2779.971863] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2779.979605] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2779.985920] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2779.994765] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2780.004897] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2780.015230] ubi0: background thread "ubi_bgt0d" started, PID 31287
[ 2780.015402] ubi0: detaching mtd0
[ 2780.028250] ubi0: mtd0 is detached
[ 2780.032745] ubi0: attaching mtd0
09:30:12 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2780.045299] ubi0: scanning is finished
[ 2780.143827] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2780.150837] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2780.157388] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2780.164974] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2780.172438] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2780.180483] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:12 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:12 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2780.188654] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2780.199034] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2780.209741] ubi0: background thread "ubi_bgt0d" started, PID 31296
[ 2780.216206] ubi0: detaching mtd0
[ 2780.227112] ubi0: mtd0 is detached
[ 2780.232035] ubi0: attaching mtd0
[ 2780.236907] ubi0: scanning is finished
09:30:12 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:12 executing program 0:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2780.316076] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2780.323324] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2780.331544] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2780.339130] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2780.346234] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2780.353753] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:12 executing program 0:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:12 executing program 0:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:12 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2780.361666] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2780.373502] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2780.383672] ubi0: background thread "ubi_bgt0d" started, PID 31310
[ 2780.390640] ubi0: detaching mtd0
[ 2780.401499] ubi0: mtd0 is detached
[ 2780.406602] ubi0: attaching mtd0
[ 2780.443773] ubi0: scanning is finished
09:30:13 executing program 0:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:13 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:13 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2780.543172] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2780.553569] ubi0: attaching mtd0
[ 2780.573020] ubi0: scanning is finished
09:30:13 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2780.665313] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2780.675335] ubi0: attaching mtd0
[ 2780.705873] ubi0: scanning is finished
[ 2780.804245] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2780.811710] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2780.818693] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2780.825198] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2780.832453] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2780.839360] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:13 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2780.846748] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2780.856554] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2780.866093] ubi0: background thread "ubi_bgt0d" started, PID 31355
[ 2780.872682] ubi0: detaching mtd0
[ 2780.882764] ubi0: mtd0 is detached
[ 2780.887151] ubi0: attaching mtd0
[ 2780.896972] ubi0: scanning is finished
[ 2780.982519] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2780.989858] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2780.996953] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2781.006883] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2781.014828] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2781.021814] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2781.030291] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2781.040979] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2781.051117] ubi0: background thread "ubi_bgt0d" started, PID 31363
[ 2781.057657] ubi: mtd0 is already attached to ubi0
[ 2781.062723] ubi0: detaching mtd0
[ 2781.070615] ubi0: mtd0 is detached
[ 2781.075169] ubi0: attaching mtd0
09:30:13 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:13 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2781.092653] ubi0: scanning is finished
[ 2781.217818] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2781.227067] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2781.234853] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2781.242139] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2781.251353] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2781.257520] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2781.266604] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2781.276809] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2781.287058] ubi0: background thread "ubi_bgt0d" started, PID 31380
[ 2781.287181] ubi: mtd0 is already attached to ubi0
[ 2781.299914] ubi0: detaching mtd0
[ 2781.311235] ubi0: mtd0 is detached
09:30:13 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:13 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2781.319851] ubi0: attaching mtd0
[ 2781.329663] ubi0: scanning is finished
[ 2781.427996] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2781.434948] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2781.444785] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2781.451261] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2781.460829] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2781.467191] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:14 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)

[ 2781.474902] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2781.487313] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2781.496848] ubi0: background thread "ubi_bgt0d" started, PID 31390
[ 2781.505010] ubi0: detaching mtd0
[ 2781.524394] ubi0: mtd0 is detached
[ 2781.529400] ubi0: attaching mtd0
[ 2781.556691] ubi0: scanning is finished
[ 2781.637905] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2781.645488] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2781.654141] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2781.661208] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2781.669025] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2781.675374] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2781.683594] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2781.693389] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2781.703090] ubi0: background thread "ubi_bgt0d" started, PID 31404
[ 2781.703311] ubi: mtd0 is already attached to ubi0
[ 2781.715800] ubi0: detaching mtd0
[ 2781.721512] ubi0: mtd0 is detached
[ 2781.725550] ubi0: attaching mtd0
09:30:14 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:14 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2781.743734] ubi0: scanning is finished
[ 2781.874786] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2781.882027] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2781.890228] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2781.896802] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2781.905178] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2781.912401] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2781.920134] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2781.929721] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2781.939824] ubi0: background thread "ubi_bgt0d" started, PID 31420
[ 2781.943860] ubi0: detaching mtd0
[ 2781.953894] ubi0: mtd0 is detached
[ 2781.959985] ubi0: attaching mtd0
09:30:14 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2781.985411] ubi0: scanning is finished
[ 2782.081834] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2782.089846] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2782.096441] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2782.104216] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2782.111951] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2782.119134] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2782.126491] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2782.137091] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2782.147743] ubi0: background thread "ubi_bgt0d" started, PID 31429
[ 2782.148793] ubi: mtd0 is already attached to ubi0
[ 2782.159739] ubi0: detaching mtd0
[ 2782.168747] ubi0: mtd0 is detached
[ 2782.173428] ubi0: attaching mtd0
09:30:14 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:14 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2782.185921] ubi0: scanning is finished
[ 2782.282048] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2782.293690] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2782.304354] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2782.311940] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2782.321671] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:14 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)

[ 2782.328457] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2782.336442] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2782.349221] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2782.358677] ubi0: background thread "ubi_bgt0d" started, PID 31439
[ 2782.365069] ubi0: detaching mtd0
[ 2782.388303] ubi0: mtd0 is detached
[ 2782.391989] ubi0: attaching mtd0
[ 2782.396062] ubi0: scanning is finished
[ 2782.463717] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2782.471879] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2782.482899] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2782.489929] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2782.496786] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2782.506296] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2782.514175] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2782.527428] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2782.537320] ubi0: background thread "ubi_bgt0d" started, PID 31452
[ 2782.537380] ubi: mtd0 is already attached to ubi0
[ 2782.550605] ubi0: detaching mtd0
[ 2782.555846] ubi0: mtd0 is detached
[ 2782.561067] ubi0: attaching mtd0
09:30:15 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:15 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2782.576452] ubi0: scanning is finished
[ 2782.691718] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2782.699428] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2782.706095] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2782.714188] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2782.721815] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2782.729838] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2782.737302] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2782.748291] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2782.757967] ubi0: background thread "ubi_bgt0d" started, PID 31468
[ 2782.764783] ubi0: detaching mtd0
[ 2782.771414] ubi0: mtd0 is detached
[ 2782.775450] ubi0: attaching mtd0
09:30:15 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2782.794449] ubi0: scanning is finished
[ 2782.886376] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2782.893765] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2782.901030] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2782.907767] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2782.914677] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2782.922162] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2782.929958] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2782.939738] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2782.949438] ubi0: background thread "ubi_bgt0d" started, PID 31478
[ 2782.949732] ubi: mtd0 is already attached to ubi0
[ 2782.961730] ubi0: detaching mtd0
[ 2782.969963] ubi0: mtd0 is detached
[ 2782.977088] ubi0: attaching mtd0
09:30:15 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:15 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2782.987447] ubi0: scanning is finished
[ 2783.093126] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2783.105938] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2783.115410] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2783.122839] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2783.130091] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:15 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))

[ 2783.136349] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2783.144021] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2783.153638] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2783.163286] ubi: mtd0 is already attached to ubi0
[ 2783.164132] ubi0: background thread "ubi_bgt0d" started, PID 31491
[ 2783.168352] ubi0: detaching mtd0
09:30:15 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2783.201204] ubi0: mtd0 is detached
[ 2783.205195] ubi0: attaching mtd0
[ 2783.214786] ubi0: scanning is finished
[ 2783.342280] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2783.349862] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2783.356806] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2783.363286] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2783.370530] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2783.376720] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2783.384489] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2783.395379] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2783.406733] ubi0: background thread "ubi_bgt0d" started, PID 31510
[ 2783.411234] ubi0: detaching mtd0
[ 2783.422699] ubi0: mtd0 is detached
[ 2783.427188] ubi0: attaching mtd0
09:30:15 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2783.446710] ubi0: scanning is finished
[ 2783.529761] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2783.536700] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2783.544440] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2783.551593] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2783.559346] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2783.565514] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:16 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2783.573847] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2783.584064] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2783.594189] ubi0: background thread "ubi_bgt0d" started, PID 31519
[ 2783.594406] ubi0: detaching mtd0
[ 2783.607401] ubi0: mtd0 is detached
[ 2783.612905] ubi0: attaching mtd0
[ 2783.625954] ubi0: scanning is finished
[ 2783.711247] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2783.720500] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2783.727260] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2783.734824] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2783.742428] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2783.749275] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2783.756615] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2783.767886] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2783.777261] ubi0: background thread "ubi_bgt0d" started, PID 31527
[ 2783.777336] ubi: mtd0 is already attached to ubi0
[ 2783.790475] ubi0: detaching mtd0
[ 2783.795433] ubi0: mtd0 is detached
[ 2783.800315] ubi0: attaching mtd0
[ 2783.811835] ubi0: scanning is finished
09:30:16 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:16 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2783.911853] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2783.919194] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2783.925820] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2783.933310] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2783.940806] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2783.947026] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:16 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)

[ 2783.955551] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2783.966024] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2783.976233] ubi0: background thread "ubi_bgt0d" started, PID 31538
[ 2783.982893] ubi: mtd0 is already attached to ubi0
[ 2783.989196] ubi0: detaching mtd0
[ 2784.001657] ubi0: mtd0 is detached
[ 2784.006024] ubi0: attaching mtd0
09:30:16 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2784.106025] ubi0: scanning is finished
[ 2784.179956] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2784.187223] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2784.194659] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2784.201215] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2784.208264] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2784.214620] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2784.222390] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2784.232054] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2784.241809] ubi0: background thread "ubi_bgt0d" started, PID 31559
[ 2784.241885] ubi0: detaching mtd0
[ 2784.254487] ubi0: mtd0 is detached
[ 2784.260910] ubi0: attaching mtd0
[ 2784.273401] ubi0: scanning is finished
09:30:16 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2784.358072] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2784.365123] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2784.373280] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2784.380854] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2784.388637] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2784.394827] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2784.403181] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2784.413786] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2784.423942] ubi0: background thread "ubi_bgt0d" started, PID 31566
[ 2784.431925] ubi0: detaching mtd0
[ 2784.440193] ubi0: mtd0 is detached
[ 2784.444520] ubi0: attaching mtd0
09:30:17 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2784.462317] ubi0: scanning is finished
[ 2784.562339] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2784.569438] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2784.576046] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2784.585749] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2784.593611] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2784.603684] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2784.611354] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2784.620853] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2784.630384] ubi0: background thread "ubi_bgt0d" started, PID 31576
[ 2784.636986] ubi: mtd0 is already attached to ubi0
[ 2784.645637] ubi0: detaching mtd0
[ 2784.650887] ubi0: mtd0 is detached
[ 2784.654720] ubi0: attaching mtd0
09:30:17 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2784.670482] ubi0: scanning is finished
09:30:17 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2784.764269] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2784.771517] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2784.778325] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2784.784918] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2784.791882] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2784.798307] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2784.805777] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2784.815218] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2784.825647] ubi0: background thread "ubi_bgt0d" started, PID 31586
[ 2784.832140] ubi: mtd0 is already attached to ubi0
[ 2784.837406] ubi0: detaching mtd0
[ 2784.844630] ubi0: mtd0 is detached
[ 2784.850554] ubi0: attaching mtd0
09:30:17 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2784.864855] ubi0: scanning is finished
09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2784.991465] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2784.999508] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2785.006453] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2785.014400] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2785.025069] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2785.032003] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2785.040119] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2785.050258] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2785.061032] ubi0: background thread "ubi_bgt0d" started, PID 31606
[ 2785.067825] ubi0: detaching mtd0
[ 2785.075700] ubi0: mtd0 is detached
[ 2785.084127] ubi0: attaching mtd0
09:30:17 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2785.114094] ubi0: scanning is finished
09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)

[ 2785.280850] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2785.293471] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2785.304164] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2785.326825] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2785.335479] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2785.345922] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2785.354096] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2785.364227] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2785.374153] ubi0: background thread "ubi_bgt0d" started, PID 31630
09:30:17 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:17 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2785.380973] ubi0: detaching mtd0
[ 2785.393507] ubi0: mtd0 is detached
[ 2785.402133] ubi0: attaching mtd0
[ 2785.455243] ubi0: scanning is finished
[ 2785.539577] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2785.549361] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2785.557741] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2785.564220] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2785.572037] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2785.578985] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:18 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:18 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2785.586296] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2785.596535] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2785.606812] ubi0: background thread "ubi_bgt0d" started, PID 31649
[ 2785.613764] ubi: mtd0 is already attached to ubi0
[ 2785.620697] ubi0: detaching mtd0
[ 2785.626902] ubi0: mtd0 is detached
[ 2785.634691] ubi0: attaching mtd0
[ 2785.657026] ubi0: scanning is finished
09:30:18 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)

[ 2785.716888] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2785.726822] ubi0: attaching mtd0
[ 2785.742119] ubi0: scanning is finished
[ 2785.856466] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2785.864042] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2785.874371] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2785.881842] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2785.890190] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2785.896854] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2785.905423] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2785.915419] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2785.925802] ubi0: background thread "ubi_bgt0d" started, PID 31673
[ 2785.925824] ubi0: detaching mtd0
[ 2785.940700] ubi0: mtd0 is detached
[ 2785.944701] ubi0: attaching mtd0
09:30:18 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2785.961096] ubi0: scanning is finished
[ 2786.047664] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2786.054571] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2786.065706] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2786.075496] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2786.084235] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2786.092059] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2786.100827] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2786.110847] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2786.120921] ubi0: background thread "ubi_bgt0d" started, PID 31681
[ 2786.121216] ubi: mtd0 is already attached to ubi0
[ 2786.133906] ubi0: detaching mtd0
[ 2786.140039] ubi0: mtd0 is detached
09:30:18 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2786.146771] ubi0: attaching mtd0
[ 2786.166519] ubi0: scanning is finished
09:30:18 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2786.295530] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2786.302585] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2786.309635] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2786.316044] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2786.324164] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2786.330844] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2786.338925] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2786.348916] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2786.358775] ubi0: background thread "ubi_bgt0d" started, PID 31699
[ 2786.365427] ubi: mtd0 is already attached to ubi0
[ 2786.371090] ubi0: detaching mtd0
[ 2786.376458] ubi0: mtd0 is detached
[ 2786.380859] ubi0: attaching mtd0
09:30:18 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:18 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2786.392338] ubi0: scanning is finished
[ 2786.502073] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2786.511697] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2786.520144] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2786.526601] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2786.534468] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2786.541425] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:19 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)

[ 2786.551414] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2786.561757] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2786.572152] ubi0: background thread "ubi_bgt0d" started, PID 31711
[ 2786.572201] ubi0: detaching mtd0
[ 2786.588257] ubi0: mtd0 is detached
[ 2786.596973] ubi0: attaching mtd0
[ 2786.635414] ubi0: scanning is finished
[ 2786.721003] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2786.728958] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2786.735520] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2786.743532] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2786.752422] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2786.759346] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2786.766745] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2786.778256] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2786.788025] ubi0: background thread "ubi_bgt0d" started, PID 31725
[ 2786.788324] ubi0: detaching mtd0
[ 2786.800554] ubi0: mtd0 is detached
[ 2786.806714] ubi0: attaching mtd0
09:30:19 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2786.819925] ubi0: scanning is finished
[ 2786.910761] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2786.920943] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2786.929282] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2786.935904] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2786.943593] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2786.950450] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2786.958712] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2786.968948] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2786.979278] ubi: mtd0 is already attached to ubi0
[ 2786.984559] ubi0: background thread "ubi_bgt0d" started, PID 31732
[ 2786.986286] ubi0: detaching mtd0
[ 2787.001219] ubi0: mtd0 is detached
[ 2787.005167] ubi0: attaching mtd0
09:30:19 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:19 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2787.013006] ubi0: scanning is finished
[ 2787.098481] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2787.105930] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2787.117888] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2787.124941] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2787.135622] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2787.142445] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2787.153175] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2787.162971] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2787.175713] ubi0: background thread "ubi_bgt0d" started, PID 31746
[ 2787.175823] ubi: mtd0 is already attached to ubi0
[ 2787.188056] ubi0: detaching mtd0
[ 2787.194184] ubi0: mtd0 is detached
09:30:19 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:19 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2787.198813] ubi0: attaching mtd0
[ 2787.213927] ubi0: scanning is finished
[ 2787.311672] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2787.319150] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2787.325986] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2787.336788] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2787.345266] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2787.354636] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2787.362251] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2787.374274] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2787.383799] ubi0: background thread "ubi_bgt0d" started, PID 31761
[ 2787.393088] ubi0: detaching mtd0
[ 2787.405358] ubi0: mtd0 is detached
09:30:19 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 2787.414098] ubi0: attaching mtd0
[ 2787.440630] ubi0: scanning is finished
[ 2787.521856] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2787.529521] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2787.536070] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2787.545732] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2787.553834] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2787.563071] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2787.570754] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2787.583218] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2787.592929] ubi0: background thread "ubi_bgt0d" started, PID 31774
[ 2787.602376] ubi0: detaching mtd0
[ 2787.609207] ubi0: mtd0 is detached
[ 2787.615617] ubi0: attaching mtd0
09:30:20 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2787.628150] ubi0: scanning is finished
09:30:20 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2787.726213] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2787.733686] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2787.740491] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2787.746815] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2787.753981] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2787.761185] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2787.769983] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2787.779936] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2787.790021] ubi0: background thread "ubi_bgt0d" started, PID 31784
[ 2787.796567] ubi0: detaching mtd0
[ 2787.809196] ubi0: mtd0 is detached
[ 2787.814417] ubi0: attaching mtd0
[ 2787.819617] ubi0: scanning is finished
09:30:20 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2787.863566] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2787.873516] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2787.888583] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2787.894864] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2787.903882] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2787.911190] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2787.920126] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2787.930265] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2787.941913] ubi0: background thread "ubi_bgt0d" started, PID 31791
[ 2787.947544] ubi: mtd0 is already attached to ubi0
[ 2787.953990] ubi0: detaching mtd0
09:30:20 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

[ 2787.963934] ubi0: mtd0 is detached
[ 2787.969384] ubi0: attaching mtd0
09:30:20 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:20 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2788.016243] ubi0: scanning is finished
[ 2788.124506] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2788.132186] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2788.140045] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2788.146443] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2788.155336] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2788.162928] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2788.171060] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2788.181289] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2788.191463] ubi0: background thread "ubi_bgt0d" started, PID 31815
[ 2788.198148] ubi: mtd0 is already attached to ubi0
[ 2788.203319] ubi0: detaching mtd0
[ 2788.210270] ubi0: mtd0 is detached
[ 2788.214935] ubi0: attaching mtd0
09:30:20 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:20 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2788.231221] ubi0: scanning is finished
[ 2788.337811] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2788.345298] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2788.353427] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2788.360558] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2788.368564] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2788.374923] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:20 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2788.385099] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2788.395015] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2788.406202] ubi0: background thread "ubi_bgt0d" started, PID 31829
[ 2788.406399] ubi0: detaching mtd0
[ 2788.426104] ubi0: mtd0 is detached
[ 2788.432055] ubi0: attaching mtd0
09:30:21 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2788.466120] ubi0: scanning is finished
[ 2788.590985] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2788.598790] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2788.605395] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2788.613502] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2788.622528] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2788.629985] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2788.638137] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2788.648479] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2788.659214] ubi0: background thread "ubi_bgt0d" started, PID 31845
[ 2788.665644] ubi: mtd0 is already attached to ubi0
[ 2788.673163] ubi0: detaching mtd0
[ 2788.678368] ubi0: mtd0 is detached
[ 2788.682528] ubi0: attaching mtd0
09:30:21 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2788.693818] ubi0: scanning is finished
09:30:21 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2788.782374] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2788.792406] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2788.799493] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2788.805835] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2788.813141] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2788.820857] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:21 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:21 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2788.828499] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2788.838478] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2788.848628] ubi0: background thread "ubi_bgt0d" started, PID 31856
[ 2788.848886] ubi: mtd0 is already attached to ubi0
[ 2788.860577] ubi0: detaching mtd0
[ 2788.865867] ubi0: mtd0 is detached
[ 2788.870329] ubi0: attaching mtd0
09:30:21 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2788.936823] ubi0: scanning is finished
[ 2789.022430] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2789.032434] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2789.039381] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2789.045750] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2789.052989] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2789.060323] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2789.068594] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2789.078601] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2789.088967] ubi0: background thread "ubi_bgt0d" started, PID 31875
[ 2789.089171] ubi0: detaching mtd0
[ 2789.103240] ubi0: mtd0 is detached
[ 2789.108997] ubi0: attaching mtd0
[ 2789.113228] ubi0: scanning is finished
09:30:21 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2789.163554] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2789.170542] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2789.177050] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2789.188393] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2789.195104] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2789.207219] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2789.214680] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2789.226499] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2789.238923] ubi0: background thread "ubi_bgt0d" started, PID 31880
[ 2789.245537] ubi: mtd0 is already attached to ubi0
[ 2789.253970] ubi0: detaching mtd0
[ 2789.259995] ubi0: mtd0 is detached
09:30:21 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:21 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2789.265100] ubi0: attaching mtd0
[ 2789.278315] ubi0: scanning is finished
09:30:21 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2789.414327] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2789.421893] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2789.429423] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2789.435822] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2789.443578] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2789.451459] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2789.459435] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2789.469314] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2789.479763] ubi0: background thread "ubi_bgt0d" started, PID 31904
[ 2789.479968] ubi: mtd0 is already attached to ubi0
[ 2789.492965] ubi0: detaching mtd0
[ 2789.500928] ubi0: mtd0 is detached
[ 2789.505526] ubi0: attaching mtd0
09:30:22 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:22 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2789.522638] ubi0: scanning is finished
[ 2789.616386] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2789.625991] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2789.633640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2789.640888] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2789.648287] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2789.654646] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2789.663436] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2789.672777] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2789.682539] ubi0: background thread "ubi_bgt0d" started, PID 31916
[ 2789.688063] ubi0: detaching mtd0
[ 2789.700751] ubi0: mtd0 is detached
[ 2789.710123] ubi0: attaching mtd0
09:30:22 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2789.714258] ubi0: scanning is finished
09:30:22 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2789.796860] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2789.804106] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2789.811708] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2789.818608] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2789.825747] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2789.832726] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2789.840554] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2789.850320] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2789.860199] ubi0: background thread "ubi_bgt0d" started, PID 31932
[ 2789.861157] ubi: mtd0 is already attached to ubi0
[ 2789.874003] ubi0: detaching mtd0
[ 2789.880321] ubi0: mtd0 is detached
[ 2789.885619] ubi0: attaching mtd0
09:30:22 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:22 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2789.900867] ubi0: scanning is finished
[ 2790.010134] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2790.018219] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2790.025038] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2790.031594] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2790.038435] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2790.044586] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2790.054253] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2790.063805] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2790.073662] ubi0: background thread "ubi_bgt0d" started, PID 31946
[ 2790.073959] ubi: mtd0 is already attached to ubi0
[ 2790.086295] ubi0: detaching mtd0
[ 2790.092026] ubi0: mtd0 is detached
[ 2790.095849] ubi0: attaching mtd0
09:30:22 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:22 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

[ 2790.116709] ubi0: scanning is finished
09:30:22 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:22 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:22 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:22 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2790.304282] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2790.316359] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2790.326307] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2790.332873] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2790.339940] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2790.346118] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2790.354273] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2790.364104] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2790.373641] ubi0: background thread "ubi_bgt0d" started, PID 31975
[ 2790.380649] ubi0: detaching mtd0
[ 2790.395440] ubi0: mtd0 is detached
09:30:22 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2790.402418] ubi0: attaching mtd0
[ 2790.412734] ubi0: scanning is finished
[ 2790.516149] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2790.523821] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2790.530779] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2790.537932] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2790.544699] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2790.551920] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2790.559729] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2790.569236] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2790.579129] ubi: mtd0 is already attached to ubi0
[ 2790.579154] ubi0: background thread "ubi_bgt0d" started, PID 31987
[ 2790.590796] ubi0: detaching mtd0
[ 2790.596111] ubi0: mtd0 is detached
[ 2790.604436] ubi0: attaching mtd0
09:30:23 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:23 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2790.616761] ubi0: scanning is finished
[ 2790.697388] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2790.704285] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2790.721426] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2790.728423] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2790.735153] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:23 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2790.744483] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2790.751883] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2790.761447] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2790.770978] ubi0: background thread "ubi_bgt0d" started, PID 31997
[ 2790.780106] ubi0: detaching mtd0
[ 2790.784947] ubi0: mtd0 is detached
[ 2790.790373] ubi0: attaching mtd0
09:30:23 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2790.841851] ubi0: scanning is finished
[ 2790.932080] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2790.940028] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2790.947625] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2790.954074] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2790.964436] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2790.970775] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2790.981614] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2790.991632] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2791.003894] ubi0: background thread "ubi_bgt0d" started, PID 32014
[ 2791.011188] ubi0: detaching mtd0
[ 2791.018951] ubi0: mtd0 is detached
[ 2791.023101] ubi0: attaching mtd0
09:30:23 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2791.045791] ubi0: scanning is finished
[ 2791.129570] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2791.138902] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2791.145941] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2791.154323] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2791.162970] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2791.171358] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2791.180832] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2791.191944] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2791.203013] ubi0: background thread "ubi_bgt0d" started, PID 32023
[ 2791.209523] ubi0: detaching mtd0
[ 2791.218091] ubi0: mtd0 is detached
[ 2791.222214] ubi0: attaching mtd0
09:30:23 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2791.242931] ubi0: scanning is finished
[ 2791.360153] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2791.368330] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2791.375162] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2791.383832] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2791.391512] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2791.398506] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2791.405853] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2791.416091] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2791.425994] ubi0: background thread "ubi_bgt0d" started, PID 32035
[ 2791.426048] ubi: mtd0 is already attached to ubi0
[ 2791.438428] ubi0: detaching mtd0
[ 2791.445018] ubi0: mtd0 is detached
[ 2791.449383] ubi0: attaching mtd0
09:30:24 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:24 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2791.464157] ubi0: scanning is finished
09:30:24 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2791.585393] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2791.593408] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2791.603704] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2791.610412] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2791.620323] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2791.626470] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2791.634174] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2791.646354] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2791.656235] ubi0: detaching mtd0
[ 2791.657076] ubi0: background thread "ubi_bgt0d" started, PID 32051
[ 2791.668941] ubi0: mtd0 is detached
[ 2791.675037] ubi0: attaching mtd0
09:30:24 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2791.690495] ubi0: scanning is finished
[ 2791.770937] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2791.779333] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2791.786181] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2791.795643] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2791.803791] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2791.814596] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2791.823188] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2791.835130] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2791.845737] ubi0: background thread "ubi_bgt0d" started, PID 32061
[ 2791.852260] ubi0: detaching mtd0
[ 2791.860169] ubi0: mtd0 is detached
[ 2791.864342] ubi0: attaching mtd0
09:30:24 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2791.875402] ubi0: scanning is finished
[ 2791.960930] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2791.968232] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2791.975123] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2791.982834] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2791.990492] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2791.996658] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:24 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2792.004973] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2792.015093] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2792.025532] ubi0: background thread "ubi_bgt0d" started, PID 32072
[ 2792.031940] ubi0: detaching mtd0
[ 2792.040440] ubi0: mtd0 is detached
[ 2792.044640] ubi0: attaching mtd0
09:30:24 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2792.075267] ubi0: scanning is finished
[ 2792.191951] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2792.199145] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2792.205688] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2792.213354] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2792.221182] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2792.228041] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2792.235423] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2792.245961] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2792.255951] ubi0: background thread "ubi_bgt0d" started, PID 32088
[ 2792.256130] ubi: mtd0 is already attached to ubi0
[ 2792.268727] ubi0: detaching mtd0
[ 2792.276264] ubi0: mtd0 is detached
[ 2792.281317] ubi0: attaching mtd0
09:30:24 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:24 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2792.291557] ubi0: scanning is finished
[ 2792.401411] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2792.408522] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2792.415138] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2792.421978] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2792.429078] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2792.435424] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2792.443602] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2792.453389] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2792.463412] ubi0: background thread "ubi_bgt0d" started, PID 32101
[ 2792.463433] ubi0: detaching mtd0
[ 2792.479029] ubi0: mtd0 is detached
[ 2792.484989] ubi0: attaching mtd0
[ 2792.500651] ubi0: scanning is finished
09:30:25 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2792.582606] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2792.592821] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2792.600530] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2792.608141] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2792.614932] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2792.622010] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:25 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2792.631144] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2792.641563] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2792.651884] ubi0: background thread "ubi_bgt0d" started, PID 32110
[ 2792.657792] ubi0: detaching mtd0
[ 2792.663541] ubi0: mtd0 is detached
[ 2792.668809] ubi0: attaching mtd0
09:30:25 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2792.715207] ubi0: scanning is finished
[ 2792.803631] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2792.810932] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2792.819476] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2792.826011] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2792.834079] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2792.842084] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2792.850553] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2792.860806] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2792.871007] ubi0: background thread "ubi_bgt0d" started, PID 32124
[ 2792.877893] ubi0: detaching mtd0
[ 2792.884537] ubi0: mtd0 is detached
[ 2792.889789] ubi0: attaching mtd0
[ 2792.900322] ubi0: scanning is finished
09:30:25 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

09:30:25 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2793.008552] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2793.019518] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2793.029657] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2793.036026] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2793.044524] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2793.051637] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:25 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2793.060141] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2793.070484] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2793.081582] ubi0: background thread "ubi_bgt0d" started, PID 32137
[ 2793.081654] ubi0: detaching mtd0
[ 2793.098970] ubi0: mtd0 is detached
[ 2793.104293] ubi0: attaching mtd0
09:30:25 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:25 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2793.170039] ubi0: scanning is finished
[ 2793.277047] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2793.284502] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2793.294478] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2793.301255] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2793.311409] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2793.318043] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2793.325464] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2793.339103] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2793.349256] ubi0: background thread "ubi_bgt0d" started, PID 32155
[ 2793.349355] ubi0: detaching mtd0
[ 2793.363654] ubi0: mtd0 is detached
[ 2793.368456] ubi0: attaching mtd0
[ 2793.377379] ubi0: scanning is finished
09:30:25 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:25 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2793.490039] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2793.498057] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2793.504953] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2793.511745] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2793.518945] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2793.525312] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2793.534007] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2793.543566] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2793.553083] ubi0: background thread "ubi_bgt0d" started, PID 32166
[ 2793.557164] ubi0: detaching mtd0
[ 2793.565015] ubi0: mtd0 is detached
[ 2793.574351] ubi0: attaching mtd0
09:30:26 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

09:30:26 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

[ 2793.596224] ubi0: scanning is finished
09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)

09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)

09:30:26 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2793.852688] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2793.870542] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2793.881211] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2793.889989] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2793.897931] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2793.904239] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2793.912776] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2793.924173] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2793.934807] ubi0: background thread "ubi_bgt0d" started, PID 32203
[ 2793.941493] ubi0: detaching mtd0
09:30:26 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2793.952222] ubi0: mtd0 is detached
[ 2793.957415] ubi0: attaching mtd0
[ 2793.975031] ubi0: scanning is finished
[ 2794.062196] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2794.069525] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2794.076152] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2794.082573] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2794.089792] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2794.096043] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2794.104751] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2794.114991] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2794.125173] ubi0: background thread "ubi_bgt0d" started, PID 32215
[ 2794.125242] ubi0: detaching mtd0
[ 2794.139865] ubi0: mtd0 is detached
[ 2794.144109] ubi0: attaching mtd0
09:30:26 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:26 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2794.159851] ubi0: scanning is finished
09:30:26 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2794.255068] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2794.262104] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2794.270682] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2794.277979] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2794.284956] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2794.296547] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2794.304993] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2794.315451] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2794.326075] ubi0: background thread "ubi_bgt0d" started, PID 32228
[ 2794.326188] ubi0: detaching mtd0
[ 2794.341645] ubi0: mtd0 is detached
[ 2794.345944] ubi0: attaching mtd0
09:30:26 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2794.363410] ubi0: scanning is finished
[ 2794.480831] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2794.487821] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2794.494678] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2794.504273] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2794.511449] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2794.520371] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2794.528546] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2794.538258] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2794.547977] ubi0: background thread "ubi_bgt0d" started, PID 32245
[ 2794.554454] ubi0: detaching mtd0
[ 2794.568474] ubi0: mtd0 is detached
[ 2794.573983] ubi0: attaching mtd0
09:30:27 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))

[ 2794.588969] ubi0: scanning is finished
[ 2794.688272] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2794.695143] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2794.705999] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2794.713164] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2794.721236] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2794.728322] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2794.735741] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2794.746150] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2794.756260] ubi0: background thread "ubi_bgt0d" started, PID 32256
[ 2794.762871] ubi0: detaching mtd0
[ 2794.769668] ubi0: mtd0 is detached
[ 2794.774153] ubi0: attaching mtd0
[ 2794.789934] ubi0: scanning is finished
09:30:27 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:27 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2794.896091] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2794.903710] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2794.911642] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2794.919107] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2794.925957] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2794.934424] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2794.942198] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2794.952159] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2794.962377] ubi0: background thread "ubi_bgt0d" started, PID 32268
[ 2794.966907] ubi: mtd0 is already attached to ubi0
[ 2794.973582] ubi0: detaching mtd0
[ 2794.980368] ubi0: mtd0 is detached
[ 2794.984705] ubi0: attaching mtd0
09:30:27 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2794.995943] ubi0: scanning is finished
09:30:27 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2795.090954] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2795.098455] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2795.105396] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2795.114667] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2795.122079] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2795.129040] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2795.136538] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2795.146083] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2795.156037] ubi0: background thread "ubi_bgt0d" started, PID 32280
[ 2795.156796] ubi0: detaching mtd0
[ 2795.171288] ubi0: mtd0 is detached
[ 2795.175219] ubi0: attaching mtd0
09:30:27 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2795.191839] ubi0: scanning is finished
[ 2795.282999] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2795.291250] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2795.301127] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2795.309619] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2795.316623] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2795.323851] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2795.332165] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2795.342360] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2795.353022] ubi0: background thread "ubi_bgt0d" started, PID 32293
[ 2795.353061] ubi0: detaching mtd0
[ 2795.376103] ubi0: mtd0 is detached
09:30:27 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2795.380739] ubi0: attaching mtd0
[ 2795.394338] ubi0: scanning is finished
09:30:27 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2795.717741] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2795.764361] ubi0: attaching mtd0
[ 2795.768955] ubi0: scanning is finished
09:30:28 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:28 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2795.915482] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2795.939309] ubi0: attaching mtd0
[ 2795.955086] ubi0: scanning is finished
09:30:28 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2796.023166] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2796.042668] ubi0: attaching mtd0
[ 2796.057516] ubi0: scanning is finished
09:30:28 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:28 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2796.117304] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2796.132144] ubi0: attaching mtd0
[ 2796.151293] ubi0: scanning is finished
[ 2796.279238] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2796.286198] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2796.293184] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2796.300003] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2796.307094] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2796.313251] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:28 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2796.320933] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2796.330303] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2796.339632] ubi0: background thread "ubi_bgt0d" started, PID 32352
[ 2796.346540] ubi0: detaching mtd0
[ 2796.364173] ubi0: mtd0 is detached
[ 2796.375983] ubi0: attaching mtd0
[ 2796.405093] ubi0: scanning is finished
[ 2796.478372] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2796.485221] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2796.493374] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2796.500877] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2796.509416] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2796.515693] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:29 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2796.524495] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2796.535086] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2796.545216] ubi0: background thread "ubi_bgt0d" started, PID 32365
[ 2796.545409] ubi0: detaching mtd0
[ 2796.557967] ubi0: mtd0 is detached
[ 2796.561677] ubi0: attaching mtd0
[ 2796.565986] ubi0: scanning is finished
[ 2796.624965] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2796.631979] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2796.640390] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2796.647619] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2796.654311] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2796.661004] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2796.668501] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2796.677793] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2796.687211] ubi0: background thread "ubi_bgt0d" started, PID 32374
[ 2796.693613] ubi0: detaching mtd0
[ 2796.703440] ubi0: mtd0 is detached
[ 2796.708155] ubi0: attaching mtd0
09:30:29 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2796.723948] ubi0: scanning is finished
[ 2796.811533] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2796.818974] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2796.825726] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2796.833759] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2796.841556] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2796.849962] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2796.859164] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2796.869692] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2796.879733] ubi0: background thread "ubi_bgt0d" started, PID 32383
[ 2796.879825] ubi0: detaching mtd0
[ 2796.894552] ubi0: mtd0 is detached
[ 2796.899228] ubi0: attaching mtd0
09:30:29 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2796.921556] ubi0: scanning is finished
[ 2797.022783] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2797.029916] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2797.036481] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2797.044499] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2797.051256] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2797.058482] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:29 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2797.065785] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2797.075852] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2797.085872] ubi: mtd0 is already attached to ubi0
[ 2797.085878] ubi0: background thread "ubi_bgt0d" started, PID 32392
[ 2797.091601] ubi0: detaching mtd0
[ 2797.114375] ubi0: mtd0 is detached
09:30:29 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2797.121656] ubi0: attaching mtd0
[ 2797.144648] ubi0: scanning is finished
09:30:29 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2797.225904] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2797.248192] ubi0: attaching mtd0
[ 2797.268566] ubi0: scanning is finished
[ 2797.398716] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2797.405786] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2797.412813] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2797.419655] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2797.426664] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2797.432930] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:30 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2797.440555] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2797.450679] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2797.460488] ubi0: background thread "ubi_bgt0d" started, PID 32418
[ 2797.468598] ubi: mtd0 is already attached to ubi0
[ 2797.474371] ubi0: detaching mtd0
[ 2797.484645] ubi0: mtd0 is detached
[ 2797.493435] ubi0: attaching mtd0
09:30:30 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2797.508290] ubi0: scanning is finished
[ 2797.610924] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2797.617965] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2797.624543] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2797.632666] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2797.640725] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2797.648092] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2797.655449] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2797.666108] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2797.676216] ubi0: background thread "ubi_bgt0d" started, PID 32430
[ 2797.682848] ubi0: detaching mtd0
[ 2797.690471] ubi0: mtd0 is detached
[ 2797.694793] ubi0: attaching mtd0
[ 2797.711164] ubi0: scanning is finished
09:30:30 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2797.802358] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2797.812793] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2797.820858] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2797.828632] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2797.835388] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2797.844050] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2797.852125] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2797.862792] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2797.872955] ubi0: background thread "ubi_bgt0d" started, PID 32438
[ 2797.873106] ubi: mtd0 is already attached to ubi0
[ 2797.887185] ubi0: detaching mtd0
[ 2797.893023] ubi0: mtd0 is detached
[ 2797.897082] ubi0: attaching mtd0
[ 2797.905342] ubi0: scanning is finished
09:30:30 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:30 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2798.029121] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2798.036101] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2798.044811] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2798.054234] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2798.063594] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2798.070798] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2798.079041] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2798.089316] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2798.099732] ubi0: background thread "ubi_bgt0d" started, PID 32450
[ 2798.106430] ubi0: detaching mtd0
[ 2798.113041] ubi0: mtd0 is detached
[ 2798.123832] ubi0: attaching mtd0
[ 2798.142575] ubi0: scanning is finished
09:30:30 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2798.265969] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2798.274367] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2798.284285] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2798.293879] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2798.303584] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:30 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2798.311615] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2798.321707] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2798.332662] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2798.344319] ubi0: background thread "ubi_bgt0d" started, PID 32464
[ 2798.350935] ubi: mtd0 is already attached to ubi0
[ 2798.355819] ubi0: detaching mtd0
09:30:30 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2798.374308] ubi0: mtd0 is detached
[ 2798.382537] ubi0: attaching mtd0
[ 2798.394990] ubi0: scanning is finished
09:30:30 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2798.497093] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2798.504617] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2798.514136] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2798.521548] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2798.530081] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2798.536723] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2798.544259] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2798.554115] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2798.564068] ubi0: background thread "ubi_bgt0d" started, PID 32478
[ 2798.564209] ubi: mtd0 is already attached to ubi0
[ 2798.576345] ubi0: detaching mtd0
[ 2798.583327] ubi0: mtd0 is detached
[ 2798.591954] ubi0: attaching mtd0
09:30:31 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2798.602723] ubi0: scanning is finished
09:30:31 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2798.721996] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2798.729849] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2798.739213] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2798.745647] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2798.753944] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2798.761140] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2798.769837] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2798.780265] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2798.790483] ubi0: background thread "ubi_bgt0d" started, PID 32491
[ 2798.797126] ubi0: detaching mtd0
[ 2798.806085] ubi0: mtd0 is detached
[ 2798.815780] ubi0: attaching mtd0
09:30:31 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2798.834140] ubi0: scanning is finished
[ 2798.946041] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2798.953274] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2798.960328] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2798.966857] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2798.973655] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2798.982636] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2798.991975] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2799.002644] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2799.012966] ubi0: background thread "ubi_bgt0d" started, PID 32505
[ 2799.013156] ubi0: detaching mtd0
[ 2799.027647] ubi0: mtd0 is detached
[ 2799.033610] ubi0: attaching mtd0
09:30:31 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2799.049762] ubi0: scanning is finished
09:30:31 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2799.141376] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2799.151543] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2799.159935] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2799.166647] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2799.173669] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2799.180229] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2799.188337] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2799.198402] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2799.208363] ubi0: background thread "ubi_bgt0d" started, PID 32515
[ 2799.214852] ubi0: detaching mtd0
[ 2799.223081] ubi0: mtd0 is detached
[ 2799.229893] ubi0: attaching mtd0
09:30:31 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2799.239788] ubi0: scanning is finished
[ 2799.329745] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2799.344510] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2799.354760] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2799.362311] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2799.373361] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2799.380829] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2799.391920] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2799.401893] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2799.415886] ubi0: background thread "ubi_bgt0d" started, PID 32525
[ 2799.416008] ubi: mtd0 is already attached to ubi0
09:30:32 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:32 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2799.429111] ubi0: detaching mtd0
[ 2799.437894] ubi0: mtd0 is detached
[ 2799.442157] ubi0: attaching mtd0
[ 2799.453932] ubi0: scanning is finished
[ 2799.569130] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2799.583624] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2799.591375] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2799.599844] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2799.608506] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2799.614973] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2799.623044] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2799.633165] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2799.643587] ubi0: background thread "ubi_bgt0d" started, PID 32538
[ 2799.643764] ubi0: detaching mtd0
[ 2799.663362] ubi0: mtd0 is detached
09:30:32 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2799.670513] ubi0: attaching mtd0
[ 2799.685285] ubi0: scanning is finished
09:30:32 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2799.825944] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2799.833487] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2799.840752] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2799.847658] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2799.854532] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2799.861113] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2799.869045] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2799.879366] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2799.890063] ubi0: background thread "ubi_bgt0d" started, PID 32556
[ 2799.897239] ubi0: detaching mtd0
[ 2799.903013] ubi0: mtd0 is detached
[ 2799.908022] ubi0: attaching mtd0
[ 2799.922484] ubi0: scanning is finished
09:30:32 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2800.006688] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2800.013692] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2800.023393] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2800.030516] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2800.038523] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2800.044651] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2800.052134] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2800.062412] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2800.072543] ubi0: background thread "ubi_bgt0d" started, PID 32564
[ 2800.079393] ubi0: detaching mtd0
[ 2800.086042] ubi0: mtd0 is detached
[ 2800.090933] ubi0: attaching mtd0
[ 2800.101802] ubi0: scanning is finished
09:30:32 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2800.193731] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2800.203251] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2800.211560] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2800.219297] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2800.230567] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2800.237000] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2800.244446] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2800.255445] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2800.265839] ubi0: background thread "ubi_bgt0d" started, PID 32576
[ 2800.272585] ubi: mtd0 is already attached to ubi0
[ 2800.278875] ubi0: detaching mtd0
09:30:32 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:32 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2800.290848] ubi0: mtd0 is detached
[ 2800.295028] ubi0: attaching mtd0
[ 2800.355533] ubi0: scanning is finished
[ 2800.446681] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2800.454481] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2800.462780] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2800.470255] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2800.478811] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2800.485247] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2800.495541] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2800.505802] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2800.516204] ubi0: background thread "ubi_bgt0d" started, PID 32593
[ 2800.516790] ubi: mtd0 is already attached to ubi0
[ 2800.528333] ubi0: detaching mtd0
[ 2800.541461] ubi0: mtd0 is detached
09:30:33 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:33 executing program 4:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2800.546124] ubi0: attaching mtd0
[ 2800.561174] ubi0: scanning is finished
09:30:33 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2800.692043] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2800.700332] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2800.708000] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2800.714368] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2800.722157] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2800.729230] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2800.737845] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2800.747811] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2800.758433] ubi0: background thread "ubi_bgt0d" started, PID 32609
[ 2800.758503] ubi0: detaching mtd0
[ 2800.773566] ubi0: mtd0 is detached
[ 2800.778849] ubi0: attaching mtd0
09:30:33 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2800.791013] ubi0: scanning is finished
[ 2800.880642] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2800.888082] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2800.894635] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2800.901432] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2800.908435] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2800.914720] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2800.923004] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2800.932968] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2800.942656] ubi0: background thread "ubi_bgt0d" started, PID 32620
[ 2800.949372] ubi: mtd0 is already attached to ubi0
[ 2800.954356] ubi0: detaching mtd0
[ 2800.963607] ubi0: mtd0 is detached
[ 2800.969364] ubi0: attaching mtd0
[ 2800.983026] ubi0: scanning is finished
09:30:33 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:33 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:33 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2801.103636] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2801.117340] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2801.128436] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2801.134833] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2801.145706] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2801.153635] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2801.164342] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2801.179107] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2801.189696] ubi0: background thread "ubi_bgt0d" started, PID 32633
[ 2801.196234] ubi0: detaching mtd0
[ 2801.203532] ubi0: mtd0 is detached
[ 2801.216586] ubi0: attaching mtd0
[ 2801.223486] ubi0: scanning is finished
09:30:33 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2801.282759] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2801.289906] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2801.305236] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2801.312197] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2801.319653] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2801.331620] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2801.339465] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2801.350071] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2801.360450] ubi0: background thread "ubi_bgt0d" started, PID 32647
[ 2801.367446] ubi0: detaching mtd0
[ 2801.375360] ubi0: mtd0 is detached
09:30:33 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2801.380430] ubi0: attaching mtd0
[ 2801.393391] ubi0: scanning is finished
[ 2801.493964] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2801.501387] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2801.511991] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2801.519052] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2801.525899] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2801.535406] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2801.543142] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2801.555725] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2801.565644] ubi0: background thread "ubi_bgt0d" started, PID 32661
[ 2801.575181] ubi0: detaching mtd0
[ 2801.584420] ubi0: mtd0 is detached
[ 2801.590255] ubi0: attaching mtd0
09:30:34 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2801.603163] ubi0: scanning is finished
[ 2801.695401] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2801.705370] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2801.714430] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2801.722093] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2801.729773] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2801.735953] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2801.745326] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2801.755409] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2801.765708] ubi0: background thread "ubi_bgt0d" started, PID 32669
[ 2801.765836] ubi0: detaching mtd0
[ 2801.778665] ubi0: mtd0 is detached
[ 2801.782821] ubi0: attaching mtd0
09:30:34 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2801.801995] ubi0: scanning is finished
09:30:34 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:34 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2801.928911] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2801.941407] ubi0: attaching mtd0
[ 2801.969872] ubi0: scanning is finished
[ 2802.039959] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2802.047045] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2802.053693] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2802.061606] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2802.069497] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2802.075699] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:34 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2802.084462] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2802.094827] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2802.105583] ubi0: background thread "ubi_bgt0d" started, PID 32694
[ 2802.112229] ubi0: detaching mtd0
[ 2802.122317] ubi0: mtd0 is detached
[ 2802.131848] ubi0: attaching mtd0
[ 2802.149170] ubi0: scanning is finished
[ 2802.214758] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2802.222828] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2802.233360] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2802.241099] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2802.251502] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:34 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2802.259073] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2802.269465] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2802.280860] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2802.295016] ubi0: background thread "ubi_bgt0d" started, PID 32705
[ 2802.295020] ubi0: detaching mtd0
[ 2802.310849] ubi0: mtd0 is detached
[ 2802.320096] ubi0: attaching mtd0
[ 2802.336895] ubi0: scanning is finished
[ 2802.415498] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2802.422584] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2802.429790] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2802.436345] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2802.443212] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2802.450000] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:35 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2802.458484] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2802.467872] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2802.477307] ubi0: background thread "ubi_bgt0d" started, PID 32714
[ 2802.483827] ubi0: detaching mtd0
[ 2802.496849] ubi0: mtd0 is detached
[ 2802.513421] ubi0: attaching mtd0
[ 2802.524756] ubi0: scanning is finished
[ 2802.611014] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2802.618657] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2802.625587] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2802.632547] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2802.640455] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2802.647186] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:35 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2802.654847] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2802.664578] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2802.674897] ubi0: background thread "ubi_bgt0d" started, PID 32722
[ 2802.681506] ubi0: detaching mtd0
[ 2802.706460] ubi0: mtd0 is detached
[ 2802.721335] ubi0: attaching mtd0
[ 2802.727289] ubi0: scanning is finished
09:30:35 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2802.785142] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2802.803652] ubi0: attaching mtd0
[ 2802.808209] ubi0: scanning is finished
09:30:35 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2802.863385] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2802.881194] ubi0: attaching mtd0
[ 2802.902885] ubi0: scanning is finished
[ 2802.985983] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2802.993272] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2803.001211] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2803.008866] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2803.015641] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2803.022644] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:35 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2803.030982] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2803.041349] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2803.051170] ubi0: background thread "ubi_bgt0d" started, PID 32749
[ 2803.058221] ubi: mtd0 is already attached to ubi0
[ 2803.065377] ubi: mtd0 is already attached to ubi0
[ 2803.073932] ubi0: detaching mtd0
[ 2803.082907] ubi0: mtd0 is detached
09:30:35 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:35 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2803.093389] ubi0: attaching mtd0
[ 2803.135133] ubi0: scanning is finished
[ 2803.229563] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2803.240126] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2803.248587] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2803.255265] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2803.262562] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2803.269240] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:35 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2803.277310] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2803.287245] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2803.297133] ubi0: background thread "ubi_bgt0d" started, PID 32766
[ 2803.303900] ubi0: detaching mtd0
[ 2803.312701] ubi0: mtd0 is detached
[ 2803.319899] ubi0: attaching mtd0
[ 2803.325803] ubi0: scanning is finished
[ 2803.412928] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2803.420641] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2803.429168] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2803.435725] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2803.442997] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2803.449647] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2803.457472] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2803.467512] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2803.478886] ubi0: background thread "ubi_bgt0d" started, PID 308
[ 2803.480302] ubi0: detaching mtd0
[ 2803.491422] ubi0: mtd0 is detached
[ 2803.495337] ubi0: attaching mtd0
[ 2803.509271] ubi0: scanning is finished
09:30:36 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2803.599042] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2803.606032] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2803.613855] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2803.620996] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2803.628797] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2803.634917] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:36 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2803.643531] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2803.654188] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2803.664433] ubi0: background thread "ubi_bgt0d" started, PID 317
[ 2803.666919] ubi0: detaching mtd0
[ 2803.676597] ubi0: mtd0 is detached
[ 2803.680605] ubi0: attaching mtd0
[ 2803.693286] ubi0: scanning is finished
[ 2803.791328] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2803.799349] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2803.808648] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2803.815339] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2803.824561] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2803.831829] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2803.840062] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2803.850358] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2803.861189] ubi0: background thread "ubi_bgt0d" started, PID 326
[ 2803.867676] ubi: mtd0 is already attached to ubi0
[ 2803.873060] ubi: mtd0 is already attached to ubi0
[ 2803.883224] ubi0: detaching mtd0
09:30:36 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:36 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2803.890477] ubi0: mtd0 is detached
[ 2803.894890] ubi0: attaching mtd0
[ 2803.907729] ubi0: scanning is finished
09:30:36 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2804.016768] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2804.023922] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2804.040638] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2804.047412] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2804.054250] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2804.063244] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2804.072481] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2804.082427] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2804.093301] ubi0: background thread "ubi_bgt0d" started, PID 340
[ 2804.093430] ubi0: detaching mtd0
[ 2804.110037] ubi0: mtd0 is detached
[ 2804.114075] ubi0: attaching mtd0
09:30:36 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2804.119225] ubi0: scanning is finished
[ 2804.193094] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2804.205576] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2804.217022] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2804.223296] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2804.231331] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2804.237728] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2804.245012] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2804.254845] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2804.265270] ubi0: background thread "ubi_bgt0d" started, PID 355
[ 2804.265274] ubi0: detaching mtd0
[ 2804.278374] ubi0: mtd0 is detached
[ 2804.282340] ubi0: attaching mtd0
09:30:36 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2804.309641] ubi0: scanning is finished
[ 2804.404980] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2804.414353] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2804.422463] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2804.431254] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2804.439606] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2804.445750] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2804.457700] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2804.467562] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2804.477311] ubi0: background thread "ubi_bgt0d" started, PID 365
[ 2804.483613] ubi0: detaching mtd0
[ 2804.491627] ubi0: mtd0 is detached
[ 2804.495702] ubi0: attaching mtd0
09:30:37 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2804.510501] ubi0: scanning is finished
[ 2804.614316] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2804.622075] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2804.629152] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2804.635640] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2804.642994] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2804.650218] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2804.658614] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2804.668246] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2804.678034] ubi0: background thread "ubi_bgt0d" started, PID 373
[ 2804.682478] ubi: mtd0 is already attached to ubi0
[ 2804.696610] ubi: mtd0 is already attached to ubi0
[ 2804.701960] ubi0: detaching mtd0
[ 2804.708386] ubi0: mtd0 is detached
09:30:37 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2804.716239] ubi0: attaching mtd0
[ 2804.732139] ubi0: scanning is finished
09:30:37 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:37 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:37 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2804.901775] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2804.909627] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2804.921040] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2804.928606] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2804.935336] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2804.945950] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2804.954300] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2804.964655] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2804.974741] ubi0: background thread "ubi_bgt0d" started, PID 396
[ 2804.974778] ubi0: detaching mtd0
[ 2804.991187] ubi0: mtd0 is detached
[ 2804.995326] ubi0: attaching mtd0
09:30:37 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2805.009390] ubi0: scanning is finished
[ 2805.106753] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2805.113940] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2805.120960] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2805.127630] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2805.134384] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2805.140953] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:37 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2805.149865] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2805.159412] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2805.169107] ubi0: detaching mtd0
[ 2805.169144] ubi0: background thread "ubi_bgt0d" started, PID 406
[ 2805.184104] ubi0: mtd0 is detached
[ 2805.191769] ubi0: attaching mtd0
[ 2805.202295] ubi0: scanning is finished
[ 2805.280921] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2805.288621] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2805.295661] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2805.303315] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2805.310718] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2805.318484] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:37 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2805.326364] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2805.335961] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2805.345859] ubi0: background thread "ubi_bgt0d" started, PID 413
[ 2805.345921] ubi0: detaching mtd0
[ 2805.373141] ubi0: mtd0 is detached
[ 2805.380882] ubi0: attaching mtd0
[ 2805.393229] ubi0: scanning is finished
09:30:37 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2805.496738] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2805.503582] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2805.513814] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2805.523546] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2805.531598] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2805.538842] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2805.547694] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2805.558090] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2805.568082] ubi0: background thread "ubi_bgt0d" started, PID 427
[ 2805.574433] ubi: mtd0 is already attached to ubi0
[ 2805.587686] ubi: mtd0 is already attached to ubi0
[ 2805.592662] ubi0: detaching mtd0
09:30:38 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:38 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2805.601964] ubi0: mtd0 is detached
[ 2805.605952] ubi0: attaching mtd0
[ 2805.622327] ubi0: scanning is finished
09:30:38 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2805.755702] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2805.767118] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2805.774160] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2805.783786] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2805.792222] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:38 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2805.799370] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2805.808447] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2805.819099] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2805.830044] ubi0: background thread "ubi_bgt0d" started, PID 443
[ 2805.840151] ubi0: detaching mtd0
[ 2805.847563] ubi0: mtd0 is detached
[ 2805.851970] ubi0: attaching mtd0
09:30:38 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:38 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2805.882399] ubi0: scanning is finished
[ 2806.006126] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2806.013004] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2806.025748] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2806.032276] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2806.042066] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2806.050202] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2806.061686] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2806.071690] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2806.084354] ubi0: background thread "ubi_bgt0d" started, PID 463
[ 2806.084566] ubi0: detaching mtd0
[ 2806.099462] ubi0: mtd0 is detached
09:30:38 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2806.103551] ubi0: attaching mtd0
[ 2806.115318] ubi0: scanning is finished
[ 2806.216197] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2806.223239] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2806.231015] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2806.237992] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2806.244785] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2806.251127] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2806.259018] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2806.268564] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2806.278462] ubi0: background thread "ubi_bgt0d" started, PID 473
[ 2806.285896] ubi: mtd0 is already attached to ubi0
[ 2806.291211] ubi0: detaching mtd0
[ 2806.297622] ubi0: mtd0 is detached
[ 2806.301661] ubi0: attaching mtd0
[ 2806.311478] ubi0: scanning is finished
09:30:38 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:38 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:38 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2806.446435] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2806.453444] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2806.461540] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2806.469066] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2806.476610] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2806.486603] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2806.494050] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2806.509100] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2806.521948] ubi0: background thread "ubi_bgt0d" started, PID 488
[ 2806.530978] ubi: mtd0 is already attached to ubi0
[ 2806.537471] ubi0: detaching mtd0
09:30:39 executing program 5:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:39 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2806.548693] ubi0: mtd0 is detached
[ 2806.557243] ubi0: attaching mtd0
[ 2806.590307] ubi0: scanning is finished
[ 2806.688226] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2806.695546] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2806.703388] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2806.710910] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2806.718558] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2806.725072] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2806.733547] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2806.743424] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2806.753199] ubi0: background thread "ubi_bgt0d" started, PID 505
[ 2806.759536] ubi0: detaching mtd0
[ 2806.765678] ubi0: mtd0 is detached
[ 2806.770634] ubi0: attaching mtd0
09:30:39 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:39 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2806.791330] ubi0: scanning is finished
[ 2806.905587] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2806.915100] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2806.924728] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2806.933786] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2806.942318] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2806.950986] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2806.960257] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2806.972447] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2806.983522] ubi0: background thread "ubi_bgt0d" started, PID 518
[ 2806.983722] ubi: mtd0 is already attached to ubi0
[ 2806.995827] ubi0: detaching mtd0
[ 2807.002529] ubi0: mtd0 is detached
09:30:39 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2807.009910] ubi0: attaching mtd0
[ 2807.025562] ubi0: scanning is finished
09:30:39 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2807.155586] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2807.163730] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2807.171335] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2807.178515] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2807.185405] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2807.192768] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2807.200468] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2807.209923] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2807.219944] ubi0: background thread "ubi_bgt0d" started, PID 532
[ 2807.227004] ubi: mtd0 is already attached to ubi0
[ 2807.232163] ubi0: detaching mtd0
[ 2807.241567] ubi0: mtd0 is detached
[ 2807.246329] ubi0: attaching mtd0
09:30:39 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2807.262160] ubi0: scanning is finished
09:30:39 executing program 5:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:39 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2807.401903] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2807.411646] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2807.419797] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2807.427296] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2807.434063] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2807.441944] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2807.451296] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2807.461738] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2807.472097] ubi0: background thread "ubi_bgt0d" started, PID 551
[ 2807.472161] ubi0: detaching mtd0
[ 2807.485116] ubi0: mtd0 is detached
[ 2807.491907] ubi0: attaching mtd0
[ 2807.508881] ubi0: scanning is finished
09:30:40 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2807.596669] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2807.603597] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2807.615099] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2807.622420] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2807.630680] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2807.637979] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2807.645343] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2807.665558] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2807.675788] ubi0: background thread "ubi_bgt0d" started, PID 560
[ 2807.682309] ubi: mtd0 is already attached to ubi0
[ 2807.689353] ubi0: detaching mtd0
09:30:40 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:40 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2807.694966] ubi0: mtd0 is detached
[ 2807.704887] ubi0: attaching mtd0
[ 2807.714985] ubi0: scanning is finished
09:30:40 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2807.844830] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2807.852177] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2807.860743] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2807.868597] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2807.875644] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2807.883802] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2807.894047] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2807.904414] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2807.914696] ubi0: background thread "ubi_bgt0d" started, PID 576
[ 2807.914795] ubi: mtd0 is already attached to ubi0
[ 2807.928114] ubi0: detaching mtd0
[ 2807.938805] ubi0: mtd0 is detached
09:30:40 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:40 executing program 5:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2807.945760] ubi0: attaching mtd0
[ 2807.960016] ubi0: scanning is finished
[ 2808.076828] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2808.083733] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2808.090540] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2808.097161] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2808.103948] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2808.112387] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2808.121296] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2808.131501] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2808.141881] ubi0: background thread "ubi_bgt0d" started, PID 592
[ 2808.146677] ubi0: detaching mtd0
[ 2808.156925] ubi0: mtd0 is detached
[ 2808.161012] ubi0: attaching mtd0
09:30:40 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2808.174291] ubi0: scanning is finished
09:30:40 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2808.276622] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2808.289411] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2808.296850] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2808.303502] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2808.310812] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2808.318147] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2808.325674] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2808.336382] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2808.345727] ubi0: background thread "ubi_bgt0d" started, PID 606
[ 2808.346121] ubi: mtd0 is already attached to ubi0
[ 2808.357174] ubi0: detaching mtd0
[ 2808.364735] ubi0: mtd0 is detached
[ 2808.372342] ubi0: attaching mtd0
09:30:40 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2808.381496] ubi0: scanning is finished
09:30:40 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2808.503563] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2808.510867] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2808.517854] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2808.524452] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2808.531447] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2808.537716] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2808.545057] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2808.554467] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2808.563988] ubi0: background thread "ubi_bgt0d" started, PID 621
[ 2808.566127] ubi: mtd0 is already attached to ubi0
[ 2808.577951] ubi0: detaching mtd0
[ 2808.585153] ubi0: mtd0 is detached
[ 2808.591731] ubi0: attaching mtd0
09:30:41 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2808.606067] ubi0: scanning is finished
09:30:41 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:41 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2808.747837] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2808.754957] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2808.765023] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2808.773094] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2808.783439] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2808.790033] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2808.800663] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2808.810248] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2808.822513] ubi0: background thread "ubi_bgt0d" started, PID 640
[ 2808.826642] ubi0: detaching mtd0
[ 2808.834377] ubi0: mtd0 is detached
[ 2808.843644] ubi0: attaching mtd0
09:30:41 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2808.855249] ubi0: scanning is finished
[ 2808.942005] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2808.951854] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2808.958868] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2808.965218] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2808.972120] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2808.979588] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2808.987117] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2808.997528] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2809.007345] ubi: mtd0 is already attached to ubi0
[ 2809.009404] ubi0: background thread "ubi_bgt0d" started, PID 649
[ 2809.012366] ubi0: detaching mtd0
[ 2809.027205] ubi0: mtd0 is detached
[ 2809.033226] ubi0: attaching mtd0
09:30:41 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:41 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2809.050060] ubi0: scanning is finished
09:30:41 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2809.199084] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2809.206285] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2809.213023] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2809.219606] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2809.226709] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2809.233012] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:41 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2809.241199] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2809.250729] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2809.260698] ubi0: background thread "ubi_bgt0d" started, PID 670
[ 2809.266964] ubi: mtd0 is already attached to ubi0
[ 2809.272080] ubi0: detaching mtd0
[ 2809.277784] ubi0: mtd0 is detached
[ 2809.284282] ubi0: attaching mtd0
09:30:41 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {0xffffffffffffffff, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2809.309683] ubi0: scanning is finished
[ 2809.403475] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2809.410524] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2809.418253] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2809.424549] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2809.432251] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2809.439144] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2809.448127] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2809.458553] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2809.468812] ubi0: background thread "ubi_bgt0d" started, PID 680
[ 2809.473717] ubi0: detaching mtd0
[ 2809.481035] ubi0: mtd0 is detached
[ 2809.485065] ubi0: attaching mtd0
[ 2809.499345] ubi0: scanning is finished
09:30:42 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:42 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2809.619540] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2809.628518] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2809.635086] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2809.643023] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2809.650901] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2809.658705] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2809.668554] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2809.679121] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2809.689553] ubi0: background thread "ubi_bgt0d" started, PID 693
[ 2809.689790] ubi: mtd0 is already attached to ubi0
[ 2809.702563] ubi0: detaching mtd0
[ 2809.709522] ubi0: mtd0 is detached
[ 2809.713786] ubi0: attaching mtd0
09:30:42 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:42 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2809.731457] ubi0: scanning is finished
[ 2809.860950] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2809.868466] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2809.875569] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2809.886709] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2809.893841] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2809.903370] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:42 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2809.911072] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2809.922203] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2809.933179] ubi0: background thread "ubi_bgt0d" started, PID 710
[ 2809.933348] ubi: mtd0 is already attached to ubi0
[ 2809.946127] ubi0: detaching mtd0
09:30:42 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:42 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2809.965417] ubi0: mtd0 is detached
[ 2809.970284] ubi0: attaching mtd0
[ 2809.988305] ubi0: scanning is finished
09:30:42 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:42 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2810.133091] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2810.140971] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2810.157940] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2810.173842] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2810.182621] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2810.190061] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2810.202936] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2810.219385] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
09:30:42 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:42 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2810.229551] ubi0: background thread "ubi_bgt0d" started, PID 728
[ 2810.237008] ubi0: detaching mtd0
[ 2810.243232] ubi0: mtd0 is detached
[ 2810.253709] ubi0: attaching mtd0
[ 2810.305049] ubi0: scanning is finished
[ 2810.404968] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2810.412194] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2810.420014] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2810.427321] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2810.434102] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2810.441806] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2810.450829] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2810.460965] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2810.471453] ubi0: background thread "ubi_bgt0d" started, PID 749
[ 2810.476587] ubi: mtd0 is already attached to ubi0
[ 2810.482650] ubi0: detaching mtd0
[ 2810.489500] ubi0: mtd0 is detached
[ 2810.493461] ubi0: attaching mtd0
[ 2810.508333] ubi0: scanning is finished
09:30:43 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:43 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2810.609395] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2810.616811] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2810.623772] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2810.636262] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2810.643387] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2810.653627] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2810.662138] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2810.675186] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2810.685794] ubi0: background thread "ubi_bgt0d" started, PID 759
[ 2810.692132] ubi0: detaching mtd0
09:30:43 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2810.710065] ubi0: mtd0 is detached
[ 2810.720864] ubi0: attaching mtd0
[ 2810.734704] ubi0: scanning is finished
[ 2810.815432] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2810.822639] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2810.830370] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2810.838700] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2810.845496] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2810.852748] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:43 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2810.861027] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2810.872275] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2810.882139] ubi0: background thread "ubi_bgt0d" started, PID 771
[ 2810.887775] ubi0: detaching mtd0
[ 2810.899745] ubi0: mtd0 is detached
09:30:43 executing program 3:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2810.914435] ubi0: attaching mtd0
[ 2810.952220] ubi0: scanning is finished
[ 2811.051542] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2811.059365] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2811.066638] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2811.073355] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2811.080612] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2811.088482] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2811.096389] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2811.105952] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2811.115474] ubi0: background thread "ubi_bgt0d" started, PID 785
[ 2811.115520] ubi0: detaching mtd0
[ 2811.132355] ubi0: mtd0 is detached
[ 2811.136597] ubi0: attaching mtd0
09:30:43 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2811.156401] ubi0: scanning is finished
[ 2811.260095] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2811.267912] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2811.274843] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2811.282922] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2811.292661] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2811.299832] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2811.308702] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2811.318945] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2811.329388] ubi0: background thread "ubi_bgt0d" started, PID 793
[ 2811.329469] ubi: mtd0 is already attached to ubi0
[ 2811.341913] ubi: mtd0 is already attached to ubi0
[ 2811.350180] ubi0: detaching mtd0
[ 2811.355496] ubi0: mtd0 is detached
09:30:43 executing program 3:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2811.361235] ubi0: attaching mtd0
09:30:43 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:43 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:43 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2811.394410] ubi0: scanning is finished
09:30:43 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2811.564475] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2811.576461] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2811.583078] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2811.590907] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2811.599145] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2811.605307] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2811.613875] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2811.625366] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2811.635530] ubi0: background thread "ubi_bgt0d" started, PID 818
[ 2811.636619] ubi0: detaching mtd0
[ 2811.649059] ubi0: mtd0 is detached
[ 2811.653340] ubi0: attaching mtd0
09:30:44 executing program 3:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2811.670751] ubi0: scanning is finished
09:30:44 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r0, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2811.788125] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2811.795188] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2811.802122] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2811.813008] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2811.820380] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2811.826986] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2811.834487] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2811.844187] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2811.853887] ubi0: background thread "ubi_bgt0d" started, PID 832
[ 2811.856322] ubi0: detaching mtd0
[ 2811.867855] ubi0: mtd0 is detached
[ 2811.873224] ubi0: attaching mtd0
09:30:44 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2811.885983] ubi0: scanning is finished
[ 2811.981485] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2811.989500] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2811.997342] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2812.003887] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2812.011760] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2812.018576] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2812.027550] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2812.037638] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2812.048552] ubi0: background thread "ubi_bgt0d" started, PID 839
[ 2812.054916] ubi: mtd0 is already attached to ubi0
[ 2812.061972] ubi: mtd0 is already attached to ubi0
[ 2812.067830] ubi0: detaching mtd0
[ 2812.075689] ubi0: mtd0 is detached
09:30:44 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:44 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:44 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2812.084405] ubi0: attaching mtd0
09:30:44 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:44 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2812.173995] ubi0: scanning is finished
09:30:44 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:44 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2812.361143] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2812.369496] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2812.376382] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2812.382801] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2812.389855] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2812.396597] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2812.403948] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2812.413403] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2812.422906] ubi0: background thread "ubi_bgt0d" started, PID 872
[ 2812.423098] ubi: mtd0 is already attached to ubi0
[ 2812.434408] ubi0: detaching mtd0
[ 2812.441573] ubi0: mtd0 is detached
[ 2812.452802] ubi0: attaching mtd0
[ 2812.462713] ubi0: scanning is finished
09:30:45 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:45 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2812.577626] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2812.584545] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2812.591406] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2812.598893] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2812.605854] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2812.611997] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:45 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:45 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2812.619546] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2812.630029] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2812.640044] ubi0: background thread "ubi_bgt0d" started, PID 884
[ 2812.646599] ubi: mtd0 is already attached to ubi0
[ 2812.652397] ubi: mtd0 is already attached to ubi0
[ 2812.659342] ubi0: detaching mtd0
[ 2812.669123] ubi0: mtd0 is detached
[ 2812.673871] ubi0: attaching mtd0
09:30:45 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:45 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2812.712747] ubi0: scanning is finished
[ 2812.855962] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2812.863417] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2812.871967] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2812.879492] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2812.887821] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2812.894102] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2812.902953] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2812.913148] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2812.923625] ubi0: background thread "ubi_bgt0d" started, PID 909
[ 2812.923856] ubi: mtd0 is already attached to ubi0
[ 2812.938002] ubi0: detaching mtd0
[ 2812.949676] ubi0: mtd0 is detached
09:30:45 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:45 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:45 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2812.957198] ubi0: attaching mtd0
[ 2812.972035] ubi0: scanning is finished
[ 2813.095284] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2813.102740] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2813.111043] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2813.118882] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2813.126795] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2813.133145] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:45 executing program 1:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2813.142818] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2813.152544] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2813.162629] ubi0: background thread "ubi_bgt0d" started, PID 925
[ 2813.162781] ubi: mtd0 is already attached to ubi0
[ 2813.177125] ubi: mtd0 is already attached to ubi0
[ 2813.185979] ubi0: detaching mtd0
09:30:45 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:45 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2813.206145] ubi0: mtd0 is detached
[ 2813.210111] ubi0: attaching mtd0
[ 2813.220879] ubi0: scanning is finished
[ 2813.348140] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2813.355166] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2813.366032] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2813.372373] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2813.382325] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2813.390335] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:45 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2813.400564] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2813.412120] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2813.424768] ubi0: background thread "ubi_bgt0d" started, PID 943
[ 2813.425932] ubi0: detaching mtd0
[ 2813.439919] ubi0: mtd0 is detached
[ 2813.444631] ubi0: attaching mtd0
09:30:46 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2813.483594] ubi0: scanning is finished
[ 2813.584219] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2813.591251] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2813.598872] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2813.605237] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2813.613412] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2813.620794] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2813.629238] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2813.639259] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2813.649923] ubi0: background thread "ubi_bgt0d" started, PID 959
[ 2813.650104] ubi0: detaching mtd0
[ 2813.668797] ubi0: mtd0 is detached
09:30:46 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2813.684713] ubi0: attaching mtd0
[ 2813.733881] ubi0: scanning is finished
[ 2813.913258] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2813.924795] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2813.932805] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2813.943863] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2813.952910] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2813.963275] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2813.973808] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2813.988042] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2813.998489] ubi0: background thread "ubi_bgt0d" started, PID 968
[ 2814.003418] ubi: mtd0 is already attached to ubi0
09:30:46 executing program 1:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2814.015131] ubi: mtd0 is already attached to ubi0
[ 2814.021929] ubi0: detaching mtd0
[ 2814.029137] ubi0: mtd0 is detached
[ 2814.033143] ubi0: attaching mtd0
09:30:46 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:46 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:46 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2814.063398] ubi0: scanning is finished
09:30:46 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:46 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:46 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)

[ 2814.284879] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2814.296893] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2814.303525] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2814.314196] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2814.321930] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:46 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

[ 2814.332009] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2814.340233] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2814.353215] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2814.363239] ubi0: detaching mtd0
[ 2814.368052] ubi0: background thread "ubi_bgt0d" started, PID 999
[ 2814.389989] ubi0: mtd0 is detached
[ 2814.394886] ubi0: attaching mtd0
[ 2814.410723] ubi0: scanning is finished
[ 2814.492677] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2814.500540] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2814.509230] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2814.517246] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2814.524271] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2814.531445] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2814.539728] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2814.549679] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2814.559666] ubi0: background thread "ubi_bgt0d" started, PID 1007
[ 2814.567057] ubi0: detaching mtd0
[ 2814.573293] ubi0: mtd0 is detached
[ 2814.578633] ubi0: attaching mtd0
09:30:47 executing program 0:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2814.590056] ubi0: scanning is finished
[ 2814.689911] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2814.698065] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2814.704954] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2814.712226] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2814.719615] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2814.726103] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2814.733953] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2814.743627] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2814.753388] ubi0: background thread "ubi_bgt0d" started, PID 1015
[ 2814.755480] ubi: mtd0 is already attached to ubi0
[ 2814.764816] ubi: mtd0 is already attached to ubi0
[ 2814.771912] ubi0: detaching mtd0
[ 2814.777638] ubi0: mtd0 is detached
[ 2814.785025] ubi0: attaching mtd0
09:30:47 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)

09:30:47 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2814.794225] ubi0: scanning is finished
09:30:47 executing program 1:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:47 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2814.952480] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2814.959653] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2814.967931] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2814.974752] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2814.981910] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2814.988918] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2814.996484] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2815.006067] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2815.015623] ubi0: background thread "ubi_bgt0d" started, PID 1037
[ 2815.022078] ubi0: detaching mtd0
[ 2815.030232] ubi0: mtd0 is detached
[ 2815.034405] ubi0: attaching mtd0
09:30:47 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2815.050247] ubi0: scanning is finished
[ 2815.136053] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2815.143102] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2815.150801] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2815.157733] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2815.164542] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2815.172321] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:47 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)

[ 2815.181047] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2815.191197] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2815.201605] ubi0: detaching mtd0
[ 2815.206605] ubi0: background thread "ubi_bgt0d" started, PID 1048
[ 2815.214539] ubi0: mtd0 is detached
[ 2815.220368] ubi0: attaching mtd0
09:30:47 executing program 0:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2815.253758] ubi0: scanning is finished
[ 2815.364916] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2815.374321] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2815.382005] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2815.389177] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2815.397222] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2815.403384] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2815.412135] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2815.422874] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2815.432831] ubi0: background thread "ubi_bgt0d" started, PID 1072
[ 2815.433029] ubi0: detaching mtd0
[ 2815.446620] ubi0: mtd0 is detached
[ 2815.452843] ubi0: attaching mtd0
09:30:48 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2815.464505] ubi0: scanning is finished
[ 2815.565095] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2815.572968] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2815.581156] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2815.587575] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2815.594404] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2815.600629] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:48 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:48 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2815.608168] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2815.617832] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2815.627754] ubi0: background thread "ubi_bgt0d" started, PID 1083
[ 2815.634151] ubi: mtd0 is already attached to ubi0
[ 2815.643565] ubi0: detaching mtd0
[ 2815.649345] ubi0: mtd0 is detached
[ 2815.653003] ubi0: attaching mtd0
[ 2815.657288] ubi0: scanning is finished
[ 2815.720684] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2815.729657] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2815.739928] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2815.746286] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2815.752963] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2815.762183] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:48 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[ 2815.769585] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2815.781463] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2815.790846] ubi0: background thread "ubi_bgt0d" started, PID 1093
[ 2815.797287] ubi0: detaching mtd0
[ 2815.803700] ubi0: mtd0 is detached
[ 2815.809066] ubi0: attaching mtd0
09:30:48 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2815.871747] ubi0: scanning is finished
[ 2815.947758] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2815.954699] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2815.961889] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2815.973848] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2815.981905] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2815.990922] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2816.000245] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.012367] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.023666] ubi0: background thread "ubi_bgt0d" started, PID 1110
[ 2816.023788] ubi0: detaching mtd0
[ 2816.040944] ubi0: mtd0 is detached
[ 2816.045090] ubi0: attaching mtd0
09:30:48 executing program 0:
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2816.059337] ubi0: scanning is finished
[ 2816.148111] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2816.155032] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2816.162713] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2816.169751] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2816.177355] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2816.183522] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:48 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2816.192562] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.202752] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.213065] ubi0: background thread "ubi_bgt0d" started, PID 1118
[ 2816.213347] ubi0: detaching mtd0
[ 2816.229699] ubi0: mtd0 is detached
[ 2816.235466] ubi0: attaching mtd0
[ 2816.244334] ubi0: scanning is finished
[ 2816.351565] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2816.359465] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2816.372511] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2816.380236] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2816.388338] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2816.394481] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2816.402993] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.413379] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.423259] ubi0: background thread "ubi_bgt0d" started, PID 1130
[ 2816.423509] ubi: mtd0 is already attached to ubi0
[ 2816.436067] ubi0: detaching mtd0
[ 2816.444839] ubi0: mtd0 is detached
09:30:48 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:49 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:49 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[ 2816.458058] ubi0: attaching mtd0
[ 2816.461986] ubi0: scanning is finished
[ 2816.547891] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2816.554688] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2816.562239] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2816.569159] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2816.576592] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2816.582682] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2816.590999] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.600963] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.610805] ubi0: background thread "ubi_bgt0d" started, PID 1144
[ 2816.615811] ubi0: detaching mtd0
[ 2816.626389] ubi0: mtd0 is detached
[ 2816.635652] ubi0: attaching mtd0
09:30:49 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2816.648695] ubi0: scanning is finished
[ 2816.734928] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2816.741917] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2816.749938] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2816.757248] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2816.764294] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2816.772906] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2816.782099] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.791678] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.801434] ubi0: background thread "ubi_bgt0d" started, PID 1157
[ 2816.808392] ubi0: detaching mtd0
[ 2816.814327] ubi0: mtd0 is detached
[ 2816.819595] ubi0: attaching mtd0
09:30:49 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2816.833974] ubi0: scanning is finished
[ 2816.913477] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2816.921425] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2816.929699] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2816.937191] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2816.944144] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2816.951395] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:49 executing program 3:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[ 2816.960443] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2816.970714] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2816.981297] ubi0: background thread "ubi_bgt0d" started, PID 1166
[ 2816.985969] ubi0: detaching mtd0
[ 2816.997393] ubi0: mtd0 is detached
[ 2817.002196] ubi0: attaching mtd0
09:30:49 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2817.044628] ubi0: scanning is finished
[ 2817.147848] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2817.154897] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2817.166253] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2817.173414] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2817.181419] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2817.188201] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2817.196009] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2817.205874] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2817.215880] ubi0: background thread "ubi_bgt0d" started, PID 1184
[ 2817.222432] ubi: mtd0 is already attached to ubi0
[ 2817.231518] ubi0: detaching mtd0
[ 2817.242141] ubi0: mtd0 is detached
09:30:49 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:49 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2817.246108] ubi0: attaching mtd0
[ 2817.252033] ubi0: scanning is finished
[ 2817.315092] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2817.335050] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2817.346383] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2817.352677] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2817.361755] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2817.368491] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2817.378440] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2817.388322] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2817.399765] ubi0: background thread "ubi_bgt0d" started, PID 1198
[ 2817.399772] ubi0: detaching mtd0
[ 2817.411061] ubi0: mtd0 is detached
09:30:49 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2817.414994] ubi0: attaching mtd0
[ 2817.430318] ubi0: scanning is finished
[ 2817.520395] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2817.527585] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2817.534185] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2817.541681] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2817.549169] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2817.556653] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:50 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:50 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2817.564043] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2817.574550] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2817.584649] ubi0: background thread "ubi_bgt0d" started, PID 1211
[ 2817.584774] ubi0: detaching mtd0
[ 2817.600476] ubi0: mtd0 is detached
[ 2817.606600] ubi0: attaching mtd0
09:30:50 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2817.678248] ubi0: scanning is finished
[ 2817.782122] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2817.789420] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2817.797520] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2817.804019] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2817.812489] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2817.819515] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2817.827695] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2817.838360] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2817.848545] ubi0: background thread "ubi_bgt0d" started, PID 1235
[ 2817.848840] ubi: mtd0 is already attached to ubi0
[ 2817.862022] ubi0: detaching mtd0
[ 2817.871457] ubi0: mtd0 is detached
[ 2817.875466] ubi0: attaching mtd0
09:30:50 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2817.879812] ubi0: scanning is finished
09:30:50 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2817.948558] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2817.955533] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2817.962107] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2817.970299] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2817.978031] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2817.984136] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2817.992149] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2818.002415] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2818.012301] ubi0: background thread "ubi_bgt0d" started, PID 1242
[ 2818.012306] ubi0: detaching mtd0
[ 2818.026311] ubi0: mtd0 is detached
[ 2818.030996] ubi0: attaching mtd0
[ 2818.044496] ubi0: scanning is finished
09:30:50 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2818.139327] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2818.149928] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2818.156944] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2818.163312] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2818.170441] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2818.177861] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:50 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x0, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2818.185508] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2818.194797] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2818.204788] ubi: mtd0 is already attached to ubi0
[ 2818.205422] ubi0: background thread "ubi_bgt0d" started, PID 1255
[ 2818.225183] ubi0: detaching mtd0
09:30:50 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2818.238949] ubi0: mtd0 is detached
[ 2818.244189] ubi0: attaching mtd0
[ 2818.260083] ubi0: scanning is finished
09:30:50 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2818.402608] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2818.409587] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2818.417472] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2818.423944] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2818.431751] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2818.438947] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2818.459178] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2818.469467] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2818.479715] ubi0: background thread "ubi_bgt0d" started, PID 1277
[ 2818.479913] ubi0: detaching mtd0
[ 2818.493599] ubi0: mtd0 is detached
[ 2818.498483] ubi0: attaching mtd0
09:30:51 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2818.513327] ubi0: scanning is finished
[ 2818.603336] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2818.611204] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2818.618185] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2818.624633] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2818.631788] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2818.638692] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:51 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2818.646612] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2818.656392] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2818.666597] ubi0: background thread "ubi_bgt0d" started, PID 1285
[ 2818.672876] ubi0: detaching mtd0
[ 2818.681788] ubi0: mtd0 is detached
[ 2818.688575] ubi0: attaching mtd0
[ 2818.692823] ubi0: scanning is finished
[ 2818.743948] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2818.750912] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2818.758892] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2818.765750] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2818.772434] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2818.779274] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2818.787202] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2818.800427] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2818.809897] ubi0: detaching mtd0
[ 2818.810017] ubi0: background thread "ubi_bgt0d" started, PID 1291
[ 2818.822755] ubi0: mtd0 is detached
[ 2818.830900] ubi0: attaching mtd0
09:30:51 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:30:51 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2818.849497] ubi0: scanning is finished
[ 2818.973531] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2818.980652] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2818.988564] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2818.994883] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2819.002624] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2819.010307] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2819.018879] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2819.029132] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2819.039171] ubi0: background thread "ubi_bgt0d" started, PID 1312
[ 2819.039336] ubi: mtd0 is already attached to ubi0
[ 2819.051593] ubi: mtd0 is already attached to ubi0
[ 2819.057334] ubi0: detaching mtd0
[ 2819.067777] ubi0: mtd0 is detached
09:30:51 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:51 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:51 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2819.078811] ubi0: attaching mtd0
[ 2819.098404] ubi0: scanning is finished
[ 2819.216900] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2819.225679] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2819.232322] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2819.239949] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2819.247347] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2819.253475] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2819.261883] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2819.271900] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2819.283149] ubi0: background thread "ubi_bgt0d" started, PID 1329
[ 2819.290613] ubi0: detaching mtd0
[ 2819.298474] ubi0: mtd0 is detached
[ 2819.304451] ubi0: attaching mtd0
[ 2819.309707] ubi0: scanning is finished
09:30:51 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2819.369497] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2819.379389] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2819.387839] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2819.394126] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2819.403473] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2819.411955] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:52 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2819.421962] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2819.432581] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2819.444133] ubi0: background thread "ubi_bgt0d" started, PID 1339
[ 2819.444137] ubi: mtd0 is already attached to ubi0
[ 2819.444186] ubi0: detaching mtd0
[ 2819.462766] ubi0: mtd0 is detached
[ 2819.467656] ubi0: attaching mtd0
09:30:52 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2819.528494] ubi0: scanning is finished
[ 2819.617572] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2819.624534] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2819.632466] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2819.644292] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2819.651777] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2819.661745] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2819.670006] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2819.683119] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2819.693647] ubi0: background thread "ubi_bgt0d" started, PID 1354
[ 2819.693934] ubi: mtd0 is already attached to ubi0
[ 2819.706670] ubi: mtd0 is already attached to ubi0
[ 2819.711688] ubi0: detaching mtd0
09:30:52 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:52 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:52 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2819.718630] ubi0: mtd0 is detached
[ 2819.722794] ubi0: attaching mtd0
[ 2819.737098] ubi0: scanning is finished
[ 2819.861035] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2819.868459] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2819.875350] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2819.881665] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2819.888575] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2819.894745] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:52 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2819.902925] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2819.912381] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2819.922105] ubi0: background thread "ubi_bgt0d" started, PID 1372
[ 2819.929680] ubi0: detaching mtd0
[ 2819.936061] ubi0: mtd0 is detached
[ 2819.939730] ubi0: attaching mtd0
[ 2819.946314] ubi0: scanning is finished
[ 2820.016489] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2820.023285] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2820.033009] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2820.041145] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2820.050597] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2820.058785] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2820.067903] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2820.077791] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2820.088199] ubi: mtd0 is already attached to ubi0
[ 2820.088751] ubi0: background thread "ubi_bgt0d" started, PID 1383
[ 2820.097026] ubi0: detaching mtd0
[ 2820.104928] ubi0: mtd0 is detached
[ 2820.110575] ubi0: attaching mtd0
09:30:52 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2820.128904] ubi0: scanning is finished
09:30:52 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2820.232396] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2820.239710] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2820.246556] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2820.252924] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2820.260095] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2820.266363] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2820.273796] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2820.284220] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2820.293978] ubi0: background thread "ubi_bgt0d" started, PID 1397
[ 2820.300648] ubi: mtd0 is already attached to ubi0
[ 2820.309731] ubi: mtd0 is already attached to ubi0
[ 2820.316085] ubi0: detaching mtd0
[ 2820.321342] ubi0: mtd0 is detached
09:30:52 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:52 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:52 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2820.330496] ubi0: attaching mtd0
[ 2820.340487] ubi0: scanning is finished
[ 2820.470210] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2820.477327] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2820.483881] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2820.491509] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2820.499023] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2820.506046] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:53 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2820.513481] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2820.524383] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2820.536248] ubi0: detaching mtd0
[ 2820.546639] ubi0: mtd0 is detached
[ 2820.550739] ubi0: attaching mtd0
[ 2820.554865] ubi0: scanning is finished
[ 2820.607534] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2820.614324] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2820.630334] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2820.636859] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2820.643536] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2820.650844] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2820.659257] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2820.669471] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2820.680358] ubi0: background thread "ubi_bgt0d" started, PID 1424
[ 2820.686710] ubi: mtd0 is already attached to ubi0
[ 2820.691595] ubi0: detaching mtd0
[ 2820.699006] ubi0: mtd0 is detached
[ 2820.703280] ubi0: attaching mtd0
09:30:53 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:30:53 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2820.719202] ubi0: scanning is finished
[ 2820.841624] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2820.848768] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2820.859193] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2820.867026] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2820.873850] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2820.881737] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2820.890256] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2820.900523] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2820.910974] ubi0: background thread "ubi_bgt0d" started, PID 1441
[ 2820.911146] ubi: mtd0 is already attached to ubi0
[ 2820.923650] ubi: mtd0 is already attached to ubi0
[ 2820.930616] ubi0: detaching mtd0
09:30:53 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2820.940798] ubi0: mtd0 is detached
[ 2820.945493] ubi0: attaching mtd0
[ 2820.953529] ubi0: scanning is finished
09:30:53 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:53 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2821.079309] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2821.086780] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2821.093469] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2821.100083] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2821.108254] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2821.114400] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:53 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2821.122646] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2821.132787] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2821.142813] ubi: mtd0 is already attached to ubi0
[ 2821.142940] ubi0: background thread "ubi_bgt0d" started, PID 1460
[ 2821.154742] ubi0: detaching mtd0
[ 2821.161137] ubi0: mtd0 is detached
[ 2821.165013] ubi0: attaching mtd0
[ 2821.169899] ubi0: scanning is finished
09:30:53 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2821.220658] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2821.227996] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2821.234516] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2821.243101] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2821.251491] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2821.258846] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2821.271551] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2821.282559] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2821.300004] ubi0: background thread "ubi_bgt0d" started, PID 1484
[ 2821.307294] ubi0: detaching mtd0
[ 2821.312152] ubi0: mtd0 is detached
09:30:53 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2821.319049] ubi0: attaching mtd0
[ 2821.332776] ubi0: scanning is finished
[ 2821.409613] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2821.416593] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2821.423262] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2821.430822] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2821.438300] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2821.444507] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:54 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2821.452845] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2821.463186] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2821.473164] ubi0: background thread "ubi_bgt0d" started, PID 1500
[ 2821.473387] ubi: mtd0 is already attached to ubi0
[ 2821.486153] ubi: mtd0 is already attached to ubi0
[ 2821.491157] ubi0: detaching mtd0
[ 2821.498903] ubi0: mtd0 is detached
[ 2821.504234] ubi0: attaching mtd0
09:30:54 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2821.532826] ubi0: scanning is finished
09:30:54 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2821.649864] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2821.657613] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2821.664219] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2821.672139] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2821.679697] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2821.686750] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:54 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2821.694194] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2821.704971] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2821.714291] ubi0: background thread "ubi_bgt0d" started, PID 1523
[ 2821.714453] ubi: mtd0 is already attached to ubi0
[ 2821.727277] ubi0: detaching mtd0
[ 2821.732173] ubi0: mtd0 is detached
[ 2821.737032] ubi0: attaching mtd0
[ 2821.741264] ubi0: scanning is finished
09:30:54 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2821.802916] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2821.810749] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2821.818714] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2821.829722] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2821.837772] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2821.844527] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2821.856146] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2821.867018] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2821.878780] ubi0: background thread "ubi_bgt0d" started, PID 1532
[ 2821.885501] ubi0: detaching mtd0
[ 2821.893198] ubi0: mtd0 is detached
[ 2821.900997] ubi0: attaching mtd0
09:30:54 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2821.912459] ubi0: scanning is finished
[ 2822.006706] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2822.013705] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2822.021640] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2822.028672] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2822.036253] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2822.042463] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:54 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2822.052194] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2822.062152] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2822.072392] ubi0: background thread "ubi_bgt0d" started, PID 1549
[ 2822.072610] ubi: mtd0 is already attached to ubi0
[ 2822.085558] ubi: mtd0 is already attached to ubi0
[ 2822.091629] ubi: mtd0 is already attached to ubi0
[ 2822.097290] ubi0: detaching mtd0
[ 2822.102192] ubi0: mtd0 is detached
09:30:54 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:30:54 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2822.124718] ubi0: attaching mtd0
09:30:54 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2822.186045] ubi0: scanning is finished
[ 2822.302202] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2822.309941] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2822.316894] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2822.323225] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2822.330437] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2822.337262] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:54 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2822.345895] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2822.356153] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2822.368231] ubi0: background thread "ubi_bgt0d" started, PID 1571
[ 2822.368335] ubi0: detaching mtd0
[ 2822.382676] ubi0: mtd0 is detached
[ 2822.387799] ubi0: attaching mtd0
[ 2822.392024] ubi0: scanning is finished
[ 2822.453334] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2822.460331] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2822.466997] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2822.473240] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2822.480018] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2822.486160] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2822.493448] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
09:30:55 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2822.502970] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2822.512275] ubi0: background thread "ubi_bgt0d" started, PID 1582
[ 2822.520045] ubi0: detaching mtd0
[ 2822.526337] ubi0: mtd0 is detached
[ 2822.532715] ubi0: attaching mtd0
[ 2822.544722] ubi0: scanning is finished
[ 2822.641260] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2822.648839] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2822.657063] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2822.663358] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2822.671681] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2822.678627] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:55 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2822.686796] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2822.696858] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2822.706877] ubi0: background thread "ubi_bgt0d" started, PID 1592
[ 2822.713267] ubi0: detaching mtd0
[ 2822.720226] ubi0: mtd0 is detached
[ 2822.724538] ubi0: attaching mtd0
[ 2822.735484] ubi0: scanning is finished
[ 2822.834521] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2822.844092] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2822.852168] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2822.859581] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2822.867112] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2822.873292] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2822.882263] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2822.892646] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2822.902980] ubi0: background thread "ubi_bgt0d" started, PID 1603
[ 2822.903149] ubi0: detaching mtd0
[ 2822.915493] ubi0: mtd0 is detached
[ 2822.921818] ubi0: attaching mtd0
09:30:55 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2822.940543] ubi0: scanning is finished
[ 2823.034156] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2823.043197] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2823.052548] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2823.061037] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2823.070468] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2823.076658] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:55 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2823.083934] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2823.094604] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2823.104461] ubi: mtd0 is already attached to ubi0
[ 2823.112212] ubi0: background thread "ubi_bgt0d" started, PID 1616
[ 2823.121220] ubi0: detaching mtd0
[ 2823.130303] ubi0: mtd0 is detached
[ 2823.134261] ubi0: attaching mtd0
09:30:55 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2823.156398] ubi0: scanning is finished
[ 2823.245010] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2823.251990] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2823.261131] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2823.267913] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2823.275932] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2823.282009] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:55 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2823.289853] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2823.299194] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2823.308571] ubi0: background thread "ubi_bgt0d" started, PID 1630
[ 2823.315182] ubi0: detaching mtd0
[ 2823.325566] ubi0: mtd0 is detached
[ 2823.334151] ubi0: attaching mtd0
[ 2823.339402] ubi0: scanning is finished
[ 2823.388858] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2823.398410] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2823.405974] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2823.412234] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2823.419029] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2823.425224] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:56 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2823.432829] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2823.443738] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2823.453709] ubi0: detaching mtd0
[ 2823.453733] ubi0: background thread "ubi_bgt0d" started, PID 1637
[ 2823.467078] ubi0: mtd0 is detached
[ 2823.471182] ubi0: attaching mtd0
[ 2823.481414] ubi0: scanning is finished
[ 2823.574058] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2823.582195] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2823.590194] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2823.597408] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2823.604172] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2823.611852] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:56 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2823.620081] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2823.630244] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2823.640103] ubi0: background thread "ubi_bgt0d" started, PID 1648
[ 2823.640108] ubi0: detaching mtd0
[ 2823.667358] ubi0: mtd0 is detached
[ 2823.671230] ubi0: attaching mtd0
[ 2823.693835] ubi0: scanning is finished
[ 2823.774328] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2823.783875] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2823.791466] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2823.798651] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2823.807196] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2823.813277] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:56 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2823.821886] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2823.831637] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2823.841465] ubi0: background thread "ubi_bgt0d" started, PID 1659
[ 2823.848164] ubi0: detaching mtd0
[ 2823.863639] ubi0: mtd0 is detached
[ 2823.869339] ubi0: attaching mtd0
[ 2823.898947] ubi0: scanning is finished
09:30:56 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2823.975995] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2823.987381] ubi0: attaching mtd0
[ 2824.015697] ubi0: scanning is finished
09:30:56 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2824.065838] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 2824.080482] ubi0: attaching mtd0
[ 2824.091885] ubi0: scanning is finished
[ 2824.168364] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2824.180352] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2824.190546] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2824.197514] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2824.204201] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
09:30:56 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x4, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2824.212378] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2824.220666] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2824.230459] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2824.240271] ubi0: background thread "ubi_bgt0d" started, PID 1685
[ 2824.246853] ubi0: detaching mtd0
[ 2824.262697] ubi0: mtd0 is detached
09:30:56 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2824.266782] ubi0: attaching mtd0
[ 2824.281413] ubi0: scanning is finished
[ 2824.381953] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2824.389570] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2824.398695] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2824.406008] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2824.412868] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2824.420589] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2824.428937] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2824.439289] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2824.449670] ubi0: background thread "ubi_bgt0d" started, PID 1698
[ 2824.449730] ubi0: detaching mtd0
[ 2824.462136] ubi0: mtd0 is detached
[ 2824.466741] ubi0: attaching mtd0
09:30:57 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2824.481888] ubi0: scanning is finished
[ 2824.601148] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2824.611511] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2824.619488] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2824.626755] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2824.633587] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2824.642544] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:57 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2824.651030] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2824.661827] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2824.672855] ubi0: background thread "ubi_bgt0d" started, PID 1709
[ 2824.680164] ubi0: detaching mtd0
[ 2824.686152] ubi0: mtd0 is detached
[ 2824.690468] ubi0: attaching mtd0
[ 2824.749786] ubi0: scanning is finished
[ 2824.855701] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2824.862839] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2824.871448] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2824.878060] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2824.885969] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2824.892253] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:57 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2824.899752] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2824.909155] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2824.918541] ubi0: background thread "ubi_bgt0d" started, PID 1721
[ 2824.925545] ubi: mtd0 is already attached to ubi0
[ 2824.931159] ubi0: detaching mtd0
[ 2824.937441] ubi0: mtd0 is detached
[ 2824.941697] ubi0: attaching mtd0
09:30:57 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2824.971519] ubi0: scanning is finished
[ 2825.061529] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2825.068607] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2825.076897] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2825.083255] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2825.091138] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2825.098173] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:30:57 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2825.105950] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2825.115810] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2825.125641] ubi0: background thread "ubi_bgt0d" started, PID 1732
[ 2825.131933] ubi0: detaching mtd0
[ 2825.147507] ubi0: mtd0 is detached
[ 2825.155726] ubi0: attaching mtd0
09:30:57 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2825.163637] ubi0: scanning is finished
[ 2825.260412] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2825.268108] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2825.275256] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2825.281642] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2825.289308] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2825.296908] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2825.304258] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2825.314987] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2825.324455] ubi0: background thread "ubi_bgt0d" started, PID 1743
[ 2825.331890] ubi0: detaching mtd0
[ 2825.338886] ubi0: mtd0 is detached
[ 2825.343178] ubi0: attaching mtd0
[ 2825.355644] ubi0: scanning is finished
09:30:57 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2825.454318] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2825.461447] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2825.469095] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2825.476309] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2825.483227] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2825.489573] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2825.497241] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2825.506623] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2825.516321] ubi0: detaching mtd0
[ 2825.517991] ubi0: background thread "ubi_bgt0d" started, PID 1754
[ 2825.529768] ubi0: mtd0 is detached
[ 2825.537815] ubi0: attaching mtd0
09:30:58 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2825.553169] ubi0: scanning is finished
[ 2825.657687] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2825.667904] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2825.675120] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2825.681479] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2825.688904] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2825.695276] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2825.702776] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2825.712384] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2825.722158] ubi: mtd0 is already attached to ubi0
[ 2825.724931] ubi0: background thread "ubi_bgt0d" started, PID 1766
[ 2825.733283] ubi0: detaching mtd0
[ 2825.741447] ubi0: mtd0 is detached
[ 2825.746522] ubi0: attaching mtd0
09:30:58 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2825.759149] ubi0: scanning is finished
09:30:58 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:58 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2825.865162] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2825.872633] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2825.881096] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2825.888916] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2825.898752] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2825.906688] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2825.914338] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2825.924976] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2825.935264] ubi0: background thread "ubi_bgt0d" started, PID 1778
[ 2825.935484] ubi0: detaching mtd0
[ 2825.951107] ubi0: mtd0 is detached
[ 2825.956412] ubi0: attaching mtd0
09:30:58 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2825.969502] ubi0: scanning is finished
[ 2826.063902] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2826.071276] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2826.081543] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2826.088260] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2826.098045] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2826.104243] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2826.111860] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2826.124681] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2826.134363] ubi0: background thread "ubi_bgt0d" started, PID 1787
[ 2826.140788] ubi: mtd0 is already attached to ubi0
[ 2826.147326] ubi: mtd0 is already attached to ubi0
[ 2826.152839] ubi0: detaching mtd0
[ 2826.158437] ubi0: mtd0 is detached
09:30:58 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:58 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2826.162656] ubi0: attaching mtd0
09:30:58 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:58 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2826.259738] ubi0: scanning is finished
[ 2826.354698] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2826.362340] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2826.373107] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2826.379530] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2826.387964] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2826.394206] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2826.402770] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2826.412541] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2826.422598] ubi0: background thread "ubi_bgt0d" started, PID 1811
[ 2826.422610] ubi0: detaching mtd0
[ 2826.435714] ubi0: mtd0 is detached
[ 2826.439591] ubi0: attaching mtd0
[ 2826.454105] ubi0: scanning is finished
09:30:59 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2826.542486] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2826.551949] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2826.560253] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2826.566843] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2826.573684] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2826.580698] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2826.588666] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2826.598595] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2826.608710] ubi0: background thread "ubi_bgt0d" started, PID 1819
[ 2826.615265] ubi: mtd0 is already attached to ubi0
[ 2826.620369] ubi0: detaching mtd0
[ 2826.627590] ubi0: mtd0 is detached
[ 2826.635005] ubi0: attaching mtd0
09:30:59 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2826.643306] ubi0: scanning is finished
09:30:59 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r1, 0x4122, 0x0)

09:30:59 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r1, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2826.754158] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2826.765349] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2826.775303] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2826.785368] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2826.793145] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2826.801126] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2826.809321] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2826.820127] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2826.830844] ubi0: background thread "ubi_bgt0d" started, PID 1833
[ 2826.831086] ubi0: detaching mtd0
[ 2826.848273] ubi0: mtd0 is detached
09:30:59 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2826.854250] ubi0: attaching mtd0
[ 2826.862219] ubi0: scanning is finished
[ 2826.934572] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2826.941367] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2826.953745] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2826.962900] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2826.971315] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2826.978301] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2826.986248] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2826.996375] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2827.006227] ubi0: background thread "ubi_bgt0d" started, PID 1845
[ 2827.006381] ubi: mtd0 is already attached to ubi0
[ 2827.018625] ubi0: detaching mtd0
[ 2827.024316] ubi0: mtd0 is detached
[ 2827.029271] ubi0: attaching mtd0
09:30:59 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2827.049060] ubi0: scanning is finished
09:30:59 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:30:59 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2827.151227] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2827.161601] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2827.173645] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2827.182233] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2827.190225] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2827.197425] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2827.205861] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2827.217695] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2827.228232] ubi0: background thread "ubi_bgt0d" started, PID 1859
[ 2827.228330] ubi: mtd0 is already attached to ubi0
[ 2827.240687] ubi0: detaching mtd0
[ 2827.248904] ubi0: mtd0 is detached
[ 2827.252918] ubi0: attaching mtd0
[ 2827.269815] ubi0: scanning is finished
09:30:59 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

09:30:59 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2827.402656] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2827.411087] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2827.420701] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2827.427749] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2827.435868] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2827.442065] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2827.450382] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2827.460414] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2827.470513] ubi0: background thread "ubi_bgt0d" started, PID 1875
[ 2827.478365] ubi0: detaching mtd0
[ 2827.483165] ubi0: mtd0 is detached
[ 2827.488479] ubi0: attaching mtd0
09:31:00 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2827.503402] ubi0: scanning is finished
[ 2827.601684] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2827.608777] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2827.619008] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2827.626152] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2827.632900] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2827.642455] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2827.650595] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2827.661415] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2827.671382] ubi0: background thread "ubi_bgt0d" started, PID 1888
[ 2827.671469] ubi: mtd0 is already attached to ubi0
[ 2827.683936] ubi: mtd0 is already attached to ubi0
[ 2827.689301] ubi0: detaching mtd0
[ 2827.698728] ubi0: mtd0 is detached
09:31:00 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:00 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:00 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2827.706119] ubi0: attaching mtd0
[ 2827.720246] ubi0: scanning is finished
[ 2827.831914] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2827.839142] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2827.846981] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2827.853290] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2827.861241] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2827.868034] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:00 executing program 4:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2827.877642] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2827.887812] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2827.898105] ubi0: background thread "ubi_bgt0d" started, PID 1904
[ 2827.898202] ubi: mtd0 is already attached to ubi0
[ 2827.910830] ubi0: detaching mtd0
[ 2827.916533] ubi0: mtd0 is detached
09:31:00 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2827.937682] ubi0: attaching mtd0
[ 2827.952356] ubi0: scanning is finished
[ 2828.061530] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2828.068800] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2828.076475] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2828.082773] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2828.090788] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2828.097716] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:00 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2828.106396] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2828.116596] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2828.126920] ubi0: background thread "ubi_bgt0d" started, PID 1920
[ 2828.133377] ubi0: detaching mtd0
[ 2828.140152] ubi0: mtd0 is detached
[ 2828.147732] ubi0: attaching mtd0
[ 2828.152237] ubi0: scanning is finished
[ 2828.227455] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2828.234272] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2828.250803] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2828.257811] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2828.266235] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2828.272708] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2828.280678] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2828.290105] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2828.299662] ubi0: background thread "ubi_bgt0d" started, PID 1929
[ 2828.304472] ubi: mtd0 is already attached to ubi0
[ 2828.310929] ubi: mtd0 is already attached to ubi0
[ 2828.318749] ubi0: detaching mtd0
[ 2828.324009] ubi0: mtd0 is detached
09:31:00 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:00 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:31:00 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2828.329554] ubi0: attaching mtd0
[ 2828.344778] ubi0: scanning is finished
[ 2828.462053] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2828.469275] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2828.478994] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2828.485472] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2828.492254] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2828.502246] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:01 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2828.510296] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2828.522810] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2828.537271] ubi0: background thread "ubi_bgt0d" started, PID 1947
[ 2828.537484] ubi: mtd0 is already attached to ubi0
[ 2828.554544] ubi0: detaching mtd0
09:31:01 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2828.568058] ubi0: mtd0 is detached
[ 2828.572914] ubi0: attaching mtd0
[ 2828.600568] ubi0: scanning is finished
[ 2828.704210] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2828.711468] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2828.718772] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2828.725764] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2828.732722] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2828.739257] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:01 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2828.747166] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2828.756640] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2828.766398] ubi0: background thread "ubi_bgt0d" started, PID 1963
[ 2828.772797] ubi0: detaching mtd0
[ 2828.786021] ubi0: mtd0 is detached
[ 2828.790484] ubi0: attaching mtd0
[ 2828.796268] ubi0: scanning is finished
[ 2828.875297] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2828.882159] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2828.891257] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2828.897700] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2828.905636] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2828.912731] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2828.920126] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2828.929809] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2828.939162] ubi: mtd0 is already attached to ubi0
[ 2828.940090] ubi0: background thread "ubi_bgt0d" started, PID 1974
[ 2828.950626] ubi: mtd0 is already attached to ubi0
[ 2828.956272] ubi0: detaching mtd0
[ 2828.961670] ubi0: mtd0 is detached
[ 2828.971333] ubi0: attaching mtd0
09:31:01 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:01 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2828.981128] ubi0: scanning is finished
09:31:01 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2829.094622] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2829.102074] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2829.110271] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2829.117882] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2829.126945] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2829.133306] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2829.142484] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2829.153059] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2829.163666] ubi0: background thread "ubi_bgt0d" started, PID 1989
[ 2829.164868] ubi: mtd0 is already attached to ubi0
[ 2829.179212] ubi0: detaching mtd0
09:31:01 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:31:01 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2829.192246] ubi0: mtd0 is detached
[ 2829.206929] ubi0: attaching mtd0
[ 2829.219530] ubi0: scanning is finished
[ 2829.340732] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2829.348154] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2829.355554] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2829.362115] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2829.369365] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2829.375834] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:01 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2829.383233] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2829.392787] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2829.402473] ubi0: background thread "ubi_bgt0d" started, PID 2007
[ 2829.410822] ubi0: detaching mtd0
[ 2829.418080] ubi0: mtd0 is detached
[ 2829.423229] ubi0: attaching mtd0
[ 2829.428946] ubi0: scanning is finished
[ 2829.489356] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2829.496285] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2829.502789] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2829.516736] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2829.526993] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2829.533833] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2829.541688] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2829.551139] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2829.560745] ubi0: background thread "ubi_bgt0d" started, PID 2015
[ 2829.564529] ubi: mtd0 is already attached to ubi0
[ 2829.572210] ubi: mtd0 is already attached to ubi0
[ 2829.578337] ubi0: detaching mtd0
[ 2829.583833] ubi0: mtd0 is detached
09:31:02 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:02 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2829.588307] ubi0: attaching mtd0
[ 2829.602909] ubi0: scanning is finished
09:31:02 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2829.726501] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2829.733421] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2829.740278] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2829.746927] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2829.753736] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2829.760348] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2829.769135] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2829.778624] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2829.788205] ubi0: background thread "ubi_bgt0d" started, PID 2033
[ 2829.794641] ubi0: detaching mtd0
[ 2829.806082] ubi0: mtd0 is detached
[ 2829.811131] ubi0: attaching mtd0
09:31:02 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2829.825671] ubi0: scanning is finished
[ 2829.921915] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2829.929810] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2829.937806] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2829.944354] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2829.951331] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2829.958095] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:02 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2829.966407] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2829.976429] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2829.986082] ubi0: background thread "ubi_bgt0d" started, PID 2045
[ 2829.986270] ubi0: detaching mtd0
[ 2829.997554] ubi0: mtd0 is detached
[ 2830.001601] ubi0: attaching mtd0
[ 2830.016099] ubi0: scanning is finished
[ 2830.093032] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2830.100393] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2830.107452] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2830.113874] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2830.121784] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2830.128198] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:02 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2830.135917] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2830.145514] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2830.155202] ubi0: background thread "ubi_bgt0d" started, PID 2054
[ 2830.155413] ubi0: detaching mtd0
[ 2830.169917] ubi0: mtd0 is detached
[ 2830.175341] ubi0: attaching mtd0
[ 2830.179882] ubi0: scanning is finished
[ 2830.257374] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2830.271079] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2830.279895] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2830.289098] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2830.296717] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2830.302804] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2830.311357] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2830.321236] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2830.331089] ubi0: background thread "ubi_bgt0d" started, PID 2065
[ 2830.331138] ubi: mtd0 is already attached to ubi0
[ 2830.343934] ubi: mtd0 is already attached to ubi0
[ 2830.351264] ubi0: detaching mtd0
09:31:02 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, 0x0)
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:02 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2830.356792] ubi0: mtd0 is detached
[ 2830.360841] ubi0: attaching mtd0
[ 2830.376261] ubi0: scanning is finished
09:31:02 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2830.474525] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2830.481404] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2830.490792] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2830.500384] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2830.508409] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2830.516709] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:03 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2830.530572] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2830.540359] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2830.550750] ubi0: background thread "ubi_bgt0d" started, PID 2078
[ 2830.550984] ubi0: detaching mtd0
[ 2830.568896] ubi0: mtd0 is detached
[ 2830.572878] ubi0: attaching mtd0
[ 2830.597606] ubi0: scanning is finished
[ 2830.683109] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2830.690432] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2830.699100] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2830.706169] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2830.712965] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2830.720228] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2830.728302] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2830.738927] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2830.749309] ubi0: background thread "ubi_bgt0d" started, PID 2093
[ 2830.749565] ubi0: detaching mtd0
[ 2830.761861] ubi0: mtd0 is detached
[ 2830.766711] ubi0: attaching mtd0
09:31:03 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, 0x0, &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2830.782262] ubi0: scanning is finished
[ 2830.853031] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2830.860419] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2830.867321] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2830.873792] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2830.880950] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2830.887417] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2830.894896] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2830.904517] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2830.913851] ubi0: background thread "ubi_bgt0d" started, PID 2100
[ 2830.913985] ubi0: detaching mtd0
[ 2830.929779] ubi0: mtd0 is detached
[ 2830.933952] ubi0: attaching mtd0
09:31:03 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2830.950009] ubi0: scanning is finished
[ 2831.042951] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2831.050161] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2831.059845] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2831.067134] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2831.073993] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2831.081767] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:03 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2831.089674] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2831.099706] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2831.109645] ubi0: background thread "ubi_bgt0d" started, PID 2111
[ 2831.109805] ubi: mtd0 is already attached to ubi0
[ 2831.121962] ubi: mtd0 is already attached to ubi0
[ 2831.127701] ubi: mtd0 is already attached to ubi0
[ 2831.133074] ubi0: detaching mtd0
09:31:03 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:03 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2831.149897] ubi0: mtd0 is detached
[ 2831.183610] ubi0: attaching mtd0
09:31:03 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2831.208110] ubi0: scanning is finished
[ 2831.297277] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2831.305162] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2831.312031] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2831.319247] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2831.326633] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2831.332754] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:03 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2831.340761] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2831.350436] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2831.360150] ubi0: background thread "ubi_bgt0d" started, PID 2131
[ 2831.366564] ubi0: detaching mtd0
[ 2831.372199] ubi0: mtd0 is detached
[ 2831.378115] ubi0: attaching mtd0
[ 2831.388513] ubi0: scanning is finished
[ 2831.474600] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2831.482073] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2831.490550] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2831.498259] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2831.506405] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2831.512839] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2831.521651] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2831.531184] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2831.540993] ubi0: background thread "ubi_bgt0d" started, PID 2142
[ 2831.541053] ubi0: detaching mtd0
[ 2831.556144] ubi0: mtd0 is detached
[ 2831.560072] ubi0: attaching mtd0
09:31:04 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2831.572239] ubi0: scanning is finished
[ 2831.663073] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2831.670794] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2831.678028] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2831.684938] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2831.691798] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2831.698632] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:04 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2831.706558] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2831.717025] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2831.726704] ubi0: background thread "ubi_bgt0d" started, PID 2153
[ 2831.733151] ubi0: detaching mtd0
[ 2831.758390] ubi0: mtd0 is detached
[ 2831.762602] ubi0: attaching mtd0
[ 2831.773735] ubi0: scanning is finished
[ 2831.854101] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2831.861985] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2831.872604] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2831.880645] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2831.889579] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2831.896824] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2831.905310] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2831.915797] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2831.926289] ubi0: background thread "ubi_bgt0d" started, PID 2165
[ 2831.932636] ubi: mtd0 is already attached to ubi0
[ 2831.939921] ubi: mtd0 is already attached to ubi0
[ 2831.945650] ubi0: detaching mtd0
[ 2831.951067] ubi0: mtd0 is detached
09:31:04 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:04 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:04 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2831.959537] ubi0: attaching mtd0
[ 2831.968986] ubi0: scanning is finished
[ 2832.064815] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2832.071799] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2832.079737] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2832.087369] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2832.094716] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2832.100864] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2832.109103] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2832.119649] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2832.129563] ubi0: background thread "ubi_bgt0d" started, PID 2176
[ 2832.129639] ubi0: detaching mtd0
[ 2832.143708] ubi0: mtd0 is detached
[ 2832.149189] ubi0: attaching mtd0
09:31:04 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2832.162026] ubi0: scanning is finished
[ 2832.242580] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2832.250263] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2832.257865] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2832.264896] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2832.271660] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2832.278715] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:04 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2832.287475] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2832.297550] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2832.307616] ubi0: background thread "ubi_bgt0d" started, PID 2189
[ 2832.314054] ubi: mtd0 is already attached to ubi0
[ 2832.319687] ubi0: detaching mtd0
[ 2832.331105] ubi0: mtd0 is detached
09:31:04 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2832.345121] ubi0: attaching mtd0
[ 2832.350706] ubi0: scanning is finished
[ 2832.440020] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2832.447165] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2832.453674] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2832.460319] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2832.468228] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2832.474379] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:05 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:05 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2832.481659] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2832.491003] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2832.500318] ubi0: background thread "ubi_bgt0d" started, PID 2204
[ 2832.505058] ubi: mtd0 is already attached to ubi0
[ 2832.511716] ubi: mtd0 is already attached to ubi0
[ 2832.519021] ubi0: detaching mtd0
[ 2832.523918] ubi0: mtd0 is detached
[ 2832.530260] ubi0: attaching mtd0
09:31:05 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2832.559818] ubi0: scanning is finished
[ 2832.663170] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2832.674033] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2832.680969] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2832.691491] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2832.698732] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2832.707843] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2832.716230] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2832.728372] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2832.738284] ubi0: background thread "ubi_bgt0d" started, PID 2219
[ 2832.744671] ubi0: detaching mtd0
[ 2832.751428] ubi0: mtd0 is detached
[ 2832.756315] ubi0: attaching mtd0
09:31:05 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2832.769435] ubi0: scanning is finished
[ 2832.858448] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2832.866082] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2832.872939] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2832.882711] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2832.890440] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2832.900188] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:05 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2832.907994] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2832.920280] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2832.929850] ubi0: background thread "ubi_bgt0d" started, PID 2231
[ 2832.938863] ubi: mtd0 is already attached to ubi0
[ 2832.943888] ubi0: detaching mtd0
09:31:05 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2832.965977] ubi0: mtd0 is detached
[ 2832.974956] ubi0: attaching mtd0
[ 2832.983398] ubi0: scanning is finished
[ 2833.107386] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2833.114469] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2833.121097] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2833.129566] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2833.137054] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2833.143327] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2833.151799] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2833.162309] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2833.172496] ubi0: background thread "ubi_bgt0d" started, PID 2247
[ 2833.178090] ubi: mtd0 is already attached to ubi0
[ 2833.184651] ubi: mtd0 is already attached to ubi0
[ 2833.190402] ubi0: detaching mtd0
[ 2833.199733] ubi0: mtd0 is detached
[ 2833.204240] ubi0: attaching mtd0
09:31:05 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:05 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:31:05 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2833.213594] ubi0: scanning is finished
[ 2833.318587] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2833.327784] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2833.335945] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2833.342247] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2833.349936] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2833.357641] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2833.365927] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2833.376229] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2833.386348] ubi0: background thread "ubi_bgt0d" started, PID 2261
[ 2833.393177] ubi0: detaching mtd0
[ 2833.400942] ubi0: mtd0 is detached
[ 2833.405924] ubi0: attaching mtd0
09:31:05 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2833.420314] ubi0: scanning is finished
[ 2833.503256] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2833.510266] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2833.518082] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2833.524991] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2833.531778] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2833.538812] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2833.546792] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2833.557802] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2833.568094] ubi0: background thread "ubi_bgt0d" started, PID 2273
[ 2833.575173] ubi: mtd0 is already attached to ubi0
[ 2833.580366] ubi0: detaching mtd0
[ 2833.595026] ubi0: mtd0 is detached
09:31:06 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

09:31:06 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2833.601873] ubi0: attaching mtd0
[ 2833.621051] ubi0: scanning is finished
[ 2833.738846] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2833.747052] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2833.753859] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2833.761473] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2833.768982] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2833.776137] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2833.783945] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2833.794979] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2833.804936] ubi: mtd0 is already attached to ubi0
[ 2833.806151] ubi0: background thread "ubi_bgt0d" started, PID 2293
[ 2833.809967] ubi: mtd0 is already attached to ubi0
[ 2833.823016] ubi0: detaching mtd0
[ 2833.829730] ubi0: mtd0 is detached
09:31:06 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:06 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

09:31:06 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2833.837305] ubi0: attaching mtd0
[ 2833.847340] ubi0: scanning is finished
[ 2833.956814] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2833.963690] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2833.973841] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2833.980801] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2833.990647] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2833.997529] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2834.008426] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2834.018579] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2834.031097] ubi0: background thread "ubi_bgt0d" started, PID 2308
[ 2834.031237] ubi0: detaching mtd0
[ 2834.048275] ubi0: mtd0 is detached
[ 2834.052346] ubi0: attaching mtd0
09:31:06 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2834.062898] ubi0: scanning is finished
[ 2834.148061] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2834.155259] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2834.162062] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2834.169999] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2834.177516] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2834.183754] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:06 executing program 4:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2834.191983] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2834.201904] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2834.212584] ubi0: background thread "ubi_bgt0d" started, PID 2322
[ 2834.212667] ubi0: detaching mtd0
[ 2834.229651] ubi0: mtd0 is detached
[ 2834.241097] ubi0: attaching mtd0
[ 2834.275135] ubi0: scanning is finished
[ 2834.367072] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2834.373910] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2834.385193] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2834.391598] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2834.399599] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2834.407386] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2834.415634] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2834.426092] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2834.437954] ubi0: background thread "ubi_bgt0d" started, PID 2334
[ 2834.438008] ubi0: detaching mtd0
[ 2834.451870] ubi0: mtd0 is detached
[ 2834.457154] ubi0: attaching mtd0
09:31:07 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2834.471219] ubi0: scanning is finished
[ 2834.570354] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2834.577881] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2834.585541] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2834.592160] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2834.599160] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2834.605957] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:07 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

09:31:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2834.613402] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2834.622903] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2834.632373] ubi0: background thread "ubi_bgt0d" started, PID 2343
[ 2834.639190] ubi: mtd0 is already attached to ubi0
[ 2834.644858] ubi: mtd0 is already attached to ubi0
[ 2834.649891] ubi0: detaching mtd0
[ 2834.660390] ubi0: mtd0 is detached
[ 2834.664982] ubi0: attaching mtd0
09:31:07 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2834.703523] ubi0: scanning is finished
[ 2834.790671] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2834.801067] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2834.808904] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2834.816195] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2834.822942] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2834.831039] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:07 executing program 4:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2834.839231] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2834.849286] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2834.859520] ubi0: background thread "ubi_bgt0d" started, PID 2358
[ 2834.859625] ubi: mtd0 is already attached to ubi0
[ 2834.872350] ubi0: detaching mtd0
[ 2834.885519] ubi0: mtd0 is detached
09:31:07 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140), 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2834.901601] ubi0: attaching mtd0
[ 2834.940499] ubi0: scanning is finished
[ 2835.020514] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2835.027856] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2835.035490] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2835.041791] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2835.049650] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2835.056443] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2835.063766] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2835.074158] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2835.083562] ubi0: background thread "ubi_bgt0d" started, PID 2374
[ 2835.083674] ubi0: detaching mtd0
[ 2835.100794] ubi0: mtd0 is detached
[ 2835.107335] ubi0: attaching mtd0
09:31:07 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2835.119544] ubi0: scanning is finished
09:31:07 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2835.233661] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2835.245736] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2835.252383] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2835.259678] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2835.266574] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2835.272826] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2835.280543] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2835.290747] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2835.302217] ubi0: background thread "ubi_bgt0d" started, PID 2387
[ 2835.303746] ubi0: detaching mtd0
[ 2835.317776] ubi0: mtd0 is detached
[ 2835.323415] ubi0: attaching mtd0
09:31:07 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2835.330566] ubi0: scanning is finished
[ 2835.387701] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2835.394603] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2835.401104] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2835.408971] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2835.416627] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2835.422708] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:08 executing program 4:
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2835.431309] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2835.442539] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2835.452504] ubi0: background thread "ubi_bgt0d" started, PID 2396
[ 2835.459072] ubi: mtd0 is already attached to ubi0
[ 2835.465262] ubi0: detaching mtd0
[ 2835.475952] ubi0: mtd0 is detached
09:31:08 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

[ 2835.490027] ubi0: attaching mtd0
[ 2835.522321] ubi0: scanning is finished
[ 2835.619438] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2835.626709] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2835.633300] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2835.641585] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2835.649418] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2835.657183] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2835.665473] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2835.675972] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2835.686077] ubi0: background thread "ubi_bgt0d" started, PID 2416
[ 2835.686206] ubi0: detaching mtd0
[ 2835.698368] ubi0: mtd0 is detached
[ 2835.703325] ubi0: attaching mtd0
09:31:08 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2835.717228] ubi0: scanning is finished
09:31:08 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2835.816334] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2835.823414] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2835.831351] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2835.838218] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2835.845703] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2835.851923] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:08 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2835.860560] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2835.870565] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2835.880550] ubi0: background thread "ubi_bgt0d" started, PID 2429
[ 2835.884577] ubi0: detaching mtd0
[ 2835.891931] ubi0: mtd0 is detached
[ 2835.897073] ubi0: attaching mtd0
[ 2835.910033] ubi0: scanning is finished
[ 2835.998386] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2836.007744] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2836.018370] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2836.025003] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2836.031747] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2836.038973] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:08 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0)

[ 2836.046876] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2836.058533] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2836.068695] ubi0: background thread "ubi_bgt0d" started, PID 2440
[ 2836.074736] ubi: mtd0 is already attached to ubi0
[ 2836.080460] ubi0: detaching mtd0
[ 2836.087710] ubi0: mtd0 is detached
09:31:08 executing program 5:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0)

[ 2836.097295] ubi0: attaching mtd0
[ 2836.112122] ubi0: scanning is finished
[ 2836.179061] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2836.191281] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2836.202055] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2836.209170] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2836.216576] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2836.222901] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2836.231375] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2836.241131] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2836.251124] ubi0: background thread "ubi_bgt0d" started, PID 2453
[ 2836.258021] ubi0: detaching mtd0
[ 2836.268551] ubi0: mtd0 is detached
[ 2836.272484] ubi0: attaching mtd0
09:31:08 executing program 0:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)

09:31:08 executing program 1:
syz_open_dev$sndpcmp(0x0, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)

[ 2836.287779] ubi0: scanning is finished
[ 2836.378214] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2836.385523] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2836.392326] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2836.402125] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2836.409618] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2836.418927] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2836.426496] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2836.438490] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2836.449785] ubi0: background thread "ubi_bgt0d" started, PID 2468
[ 2836.454578] ubi0: detaching mtd0
[ 2836.461256] ubi0: mtd0 is detached
[ 2836.465563] ubi0: attaching mtd0
09:31:09 executing program 2:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {0xffffffffffffffff, 0x1024}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, 0x0, 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2836.478577] ubi0: scanning is finished
[ 2836.565667] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 2836.572711] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2836.580287] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 2836.587716] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 2836.595308] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 2836.601764] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
09:31:09 executing program 3:
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0xc5f22fe58179d6aa, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
clock_gettime(0x0, &(0x7f0000000100))
userfaultfd(0x0)
ppoll(&(0x7f0000000200)=[{r1, 0x40}, {}, {0xffffffffffffffff, 0x1000}, {}, {r2, 0x142}], 0x5, &(0x7f00000001c0), &(0x7f0000000140)={[0x1bfef]}, 0x8)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x240082, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r3, 0x4122, 0x0)

[ 2836.610478] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 806427054
[ 2836.620494] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2836.630830] ubi0: background thread "ubi_bgt0d" started, PID 2477
[ 2836.634555] ubi0: detaching mtd0
[ 3008.191929] INFO: task syz-executor.4:2446 blocked for more than 140 seconds.
[ 3008.199328]       Not tainted 4.14.184-syzkaller #0
[ 3008.205379] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3008.213438] syz-executor.4  D30048  2446   6357 0x00000004
[ 3008.219074] Call Trace:
[ 3008.221721]  __schedule+0x8a6/0x1d70
[ 3008.225443]  ? firmware_map_remove+0x18f/0x18f
[ 3008.230016]  ? trace_hardirqs_on+0x10/0x10
[ 3008.234500]  schedule+0x8d/0x1b0
[ 3008.237861]  schedule_timeout+0x86c/0xe50
[ 3008.242066]  ? usleep_range+0x130/0x130
[ 3008.246038]  ? wait_for_common+0x26a/0x430
[ 3008.250309]  ? mark_held_locks+0xa6/0xf0
[ 3008.254486]  ? _raw_spin_unlock_irq+0x24/0x90
[ 3008.259033]  wait_for_common+0x272/0x430
[ 3008.263163]  ? try_to_wake_up+0x7ee/0x1110
[ 3008.267390]  ? out_of_line_wait_on_atomic_t+0x1a0/0x1a0
[ 3008.272987]  ? wake_up_q+0xe0/0xe0
[ 3008.276543]  kthread_stop+0xce/0x640
[ 3008.280247]  ubi_detach_mtd_dev+0x1e3/0x3cc
[ 3008.284620]  ctrl_cdev_ioctl+0x14b/0x220
[ 3008.288676]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.293312]  ? selinux_file_ioctl+0x3f7/0x560
[ 3008.297799]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.302439]  do_vfs_ioctl+0x75a/0xfe0
[ 3008.306232]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3008.311904]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3008.316347]  ? security_file_ioctl+0x76/0xb0
[ 3008.320736]  ? security_file_ioctl+0x83/0xb0
[ 3008.325219]  SyS_ioctl+0x7f/0xb0
[ 3008.328577]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3008.332607]  do_syscall_64+0x1d5/0x640
[ 3008.336491]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3008.341737] RIP: 0033:0x45ca59
[ 3008.344923] RSP: 002b:00007f3a90099c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3008.352714] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3008.359983] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000003
[ 3008.367314] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3008.374662] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3008.381981] R13: 000000000000020e R14: 00000000004c4557 R15: 00007f3a9009a6d4
[ 3008.389275] INFO: task syz-executor.4:2452 blocked for more than 140 seconds.
[ 3008.396599]       Not tainted 4.14.184-syzkaller #0
[ 3008.401600] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3008.409645] syz-executor.4  D30080  2452   6357 0x00000004
[ 3008.415357] Call Trace:
[ 3008.417932]  __schedule+0x8a6/0x1d70
[ 3008.421672]  ? firmware_map_remove+0x18f/0x18f
[ 3008.426257]  ? lock_downgrade+0x6e0/0x6e0
[ 3008.430394]  schedule+0x8d/0x1b0
[ 3008.433829]  schedule_preempt_disabled+0xf/0x20
[ 3008.438488]  __mutex_lock+0x5f0/0x1430
[ 3008.442567]  ? lock_downgrade+0x6e0/0x6e0
[ 3008.446730]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3008.452248]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3008.456476]  ? __mutex_unlock_slowpath+0x75/0x780
[ 3008.461295]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3008.466806]  ? __get_mtd_device+0x130/0x130
[ 3008.471154]  ? __might_fault+0x177/0x1b0
[ 3008.475283]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3008.479508]  ctrl_cdev_ioctl+0x190/0x220
[ 3008.483626]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.488202]  ? selinux_file_ioctl+0x3f7/0x560
[ 3008.492769]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.497342]  do_vfs_ioctl+0x75a/0xfe0
[ 3008.501123]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3008.506800]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3008.511208]  ? security_file_ioctl+0x76/0xb0
[ 3008.515685]  ? security_file_ioctl+0x83/0xb0
[ 3008.520088]  SyS_ioctl+0x7f/0xb0
[ 3008.523516]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3008.527481]  do_syscall_64+0x1d5/0x640
[ 3008.531350]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3008.536598] RIP: 0033:0x45ca59
[ 3008.539861] RSP: 002b:00007f3a90078c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3008.547614] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3008.555053] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000004
[ 3008.562368] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
[ 3008.569642] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3008.576971] R13: 000000000000020e R14: 00000000004c4557 R15: 00007f3a900796d4
[ 3008.584333] INFO: task syz-executor.5:2451 blocked for more than 140 seconds.
[ 3008.591592]       Not tainted 4.14.184-syzkaller #0
[ 3008.596687] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3008.604782] syz-executor.5  D30080  2451  24374 0x00000004
[ 3008.610494] Call Trace:
[ 3008.613170]  __schedule+0x8a6/0x1d70
[ 3008.616890]  ? firmware_map_remove+0x18f/0x18f
[ 3008.621451]  ? lock_downgrade+0x6e0/0x6e0
[ 3008.625747]  schedule+0x8d/0x1b0
[ 3008.629133]  schedule_preempt_disabled+0xf/0x20
[ 3008.633875]  __mutex_lock+0x5f0/0x1430
[ 3008.637759]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3008.642064]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3008.647510]  ? __might_fault+0x104/0x1b0
[ 3008.651563]  ? lock_acquire+0x170/0x3f0
[ 3008.655736]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3008.659991]  ctrl_cdev_ioctl+0x142/0x220
[ 3008.664103]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.668685]  ? selinux_file_ioctl+0x3f7/0x560
[ 3008.673347]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.677921]  do_vfs_ioctl+0x75a/0xfe0
[ 3008.681787]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3008.687405]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3008.691885]  ? security_file_ioctl+0x76/0xb0
[ 3008.696287]  ? security_file_ioctl+0x83/0xb0
[ 3008.700687]  SyS_ioctl+0x7f/0xb0
[ 3008.704110]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3008.708078]  do_syscall_64+0x1d5/0x640
[ 3008.712047]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3008.717231] RIP: 0033:0x45ca59
[ 3008.720395] RSP: 002b:00007fc67e41ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3008.728163] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3008.735509] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004
[ 3008.742831] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3008.750091] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3008.757675] R13: 000000000000020e R14: 00000000004c4557 R15: 00007fc67e41b6d4
[ 3008.765065] INFO: task syz-executor.5:2457 blocked for more than 140 seconds.
[ 3008.772469]       Not tainted 4.14.184-syzkaller #0
[ 3008.777471] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3008.785527] syz-executor.5  D28592  2457  24374 0x00000004
[ 3008.791154] Call Trace:
[ 3008.793814]  __schedule+0x8a6/0x1d70
[ 3008.797541]  ? firmware_map_remove+0x18f/0x18f
[ 3008.802174]  ? lock_downgrade+0x6e0/0x6e0
[ 3008.806333]  schedule+0x8d/0x1b0
[ 3008.809675]  schedule_preempt_disabled+0xf/0x20
[ 3008.814405]  __mutex_lock+0x5f0/0x1430
[ 3008.818285]  ? lock_downgrade+0x6e0/0x6e0
[ 3008.822492]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3008.827937]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3008.832306]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3008.837792]  ? __get_mtd_device+0x130/0x130
[ 3008.842169]  ? __might_fault+0x177/0x1b0
[ 3008.846234]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3008.850463]  ctrl_cdev_ioctl+0x190/0x220
[ 3008.854588]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.859171]  ? selinux_file_ioctl+0x3f7/0x560
[ 3008.863856]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3008.868428]  do_vfs_ioctl+0x75a/0xfe0
[ 3008.872292]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3008.877910]  ? check_preemption_disabled+0x35/0x240
[ 3008.882987]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3008.887393]  ? security_file_ioctl+0x76/0xb0
[ 3008.891865]  ? security_file_ioctl+0x83/0xb0
[ 3008.896267]  SyS_ioctl+0x7f/0xb0
[ 3008.899610]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3008.903643]  do_syscall_64+0x1d5/0x640
[ 3008.907527]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3008.912804] RIP: 0033:0x45ca59
[ 3008.915989] RSP: 002b:00007fc67e3f9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3008.923761] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3008.931029] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000006
[ 3008.938380] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
[ 3008.945697] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3008.953061] R13: 000000000000020e R14: 00000000004c4557 R15: 00007fc67e3fa6d4
[ 3008.960356] INFO: task syz-executor.0:2464 blocked for more than 140 seconds.
[ 3008.967694]       Not tainted 4.14.184-syzkaller #0
[ 3008.972773] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3008.980722] syz-executor.0  D30080  2464   6356 0x00000004
[ 3008.986406] Call Trace:
[ 3008.988995]  __schedule+0x8a6/0x1d70
[ 3008.992789]  ? firmware_map_remove+0x18f/0x18f
[ 3008.997365]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.001493]  schedule+0x8d/0x1b0
[ 3009.004920]  schedule_preempt_disabled+0xf/0x20
[ 3009.009579]  __mutex_lock+0x5f0/0x1430
[ 3009.013549]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.017798]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.023303]  ? __might_fault+0x104/0x1b0
[ 3009.027362]  ? lock_acquire+0x170/0x3f0
[ 3009.031354]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.035649]  ctrl_cdev_ioctl+0x142/0x220
[ 3009.039728]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.044385]  ? selinux_file_ioctl+0x3f7/0x560
[ 3009.048886]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.053516]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.057310]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.062987]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.067418]  ? security_file_ioctl+0x76/0xb0
[ 3009.072058]  ? security_file_ioctl+0x83/0xb0
[ 3009.076473]  SyS_ioctl+0x7f/0xb0
[ 3009.079818]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3009.083870]  do_syscall_64+0x1d5/0x640
[ 3009.087762]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3009.093008] RIP: 0033:0x45ca59
[ 3009.096201] RSP: 002b:00007f2bbd1a0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3009.103964] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3009.111222] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004
[ 3009.118542] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3009.125859] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3009.133186] R13: 000000000000020e R14: 00000000004c4557 R15: 00007f2bbd1a16d4
[ 3009.140512] INFO: task syz-executor.1:2465 blocked for more than 140 seconds.
[ 3009.147862]       Not tainted 4.14.184-syzkaller #0
[ 3009.152953] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3009.160904] syz-executor.1  D30080  2465   6359 0x00000004
[ 3009.166657] Call Trace:
[ 3009.169243]  __schedule+0x8a6/0x1d70
[ 3009.173032]  ? firmware_map_remove+0x18f/0x18f
[ 3009.177631]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.181843]  schedule+0x8d/0x1b0
[ 3009.185206]  schedule_preempt_disabled+0xf/0x20
[ 3009.189880]  __mutex_lock+0x5f0/0x1430
[ 3009.193814]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.198069]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.203565]  ? __might_fault+0x104/0x1b0
[ 3009.207644]  ? lock_acquire+0x170/0x3f0
[ 3009.211680]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.215912]  ctrl_cdev_ioctl+0x142/0x220
[ 3009.219948]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.224588]  ? selinux_file_ioctl+0x3f7/0x560
[ 3009.229070]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.233709]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.237502]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.243188]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.247594]  ? security_file_ioctl+0x76/0xb0
[ 3009.252084]  ? security_file_ioctl+0x83/0xb0
[ 3009.256485]  SyS_ioctl+0x7f/0xb0
[ 3009.259836]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3009.263866]  do_syscall_64+0x1d5/0x640
[ 3009.267754]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3009.272989] RIP: 0033:0x45ca59
[ 3009.276165] RSP: 002b:00007fde903fec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3009.284058] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3009.291323] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000004
[ 3009.298669] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3009.305984] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3009.313340] R13: 000000000000020e R14: 00000000004c4557 R15: 00007fde903ff6d4
[ 3009.320638] INFO: task syz-executor.2:2474 blocked for more than 140 seconds.
[ 3009.328000]       Not tainted 4.14.184-syzkaller #0
[ 3009.333088] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3009.341038] syz-executor.2  D28992  2474   6358 0x00000004
[ 3009.346733] Call Trace:
[ 3009.349320]  __schedule+0x8a6/0x1d70
[ 3009.353087]  ? firmware_map_remove+0x18f/0x18f
[ 3009.357666]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.361868]  schedule+0x8d/0x1b0
[ 3009.365235]  schedule_preempt_disabled+0xf/0x20
[ 3009.369891]  __mutex_lock+0x5f0/0x1430
[ 3009.373837]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.378068]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.383576]  ? __might_fault+0x104/0x1b0
[ 3009.387645]  ? lock_acquire+0x170/0x3f0
[ 3009.391696]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.395939]  ctrl_cdev_ioctl+0x142/0x220
[ 3009.399992]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.404635]  ? selinux_file_ioctl+0x3f7/0x560
[ 3009.409121]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.413797]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.417592]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.423267]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.427672]  ? security_file_ioctl+0x76/0xb0
[ 3009.432129]  ? security_file_ioctl+0x83/0xb0
[ 3009.436528]  SyS_ioctl+0x7f/0xb0
[ 3009.439875]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3009.443910]  do_syscall_64+0x1d5/0x640
[ 3009.447792]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3009.453031] RIP: 0033:0x45ca59
[ 3009.456209] RSP: 002b:00007efcb6a51c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3009.463968] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3009.471230] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005
[ 3009.478828] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3009.486162] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3009.493641] R13: 000000000000020e R14: 00000000004c4557 R15: 00007efcb6a526d4
[ 3009.500918] INFO: task syz-executor.2:2478 blocked for more than 140 seconds.
[ 3009.508259]       Not tainted 4.14.184-syzkaller #0
[ 3009.513373] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3009.521322] syz-executor.2  D29200  2478   6358 0x00000004
[ 3009.527018] Call Trace:
[ 3009.529609]  __schedule+0x8a6/0x1d70
[ 3009.533499]  ? firmware_map_remove+0x18f/0x18f
[ 3009.538125]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.542327]  schedule+0x8d/0x1b0
[ 3009.545693]  schedule_preempt_disabled+0xf/0x20
[ 3009.550348]  __mutex_lock+0x5f0/0x1430
[ 3009.554301]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.558509]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3009.562816]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.568319]  ? get_mtd_device+0xe6/0x170
[ 3009.572450]  ? __get_mtd_device+0x130/0x130
[ 3009.576762]  ? __might_fault+0x177/0x1b0
[ 3009.580801]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3009.585079]  ctrl_cdev_ioctl+0x190/0x220
[ 3009.589140]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.593802]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.598382]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.602252]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.607874]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.612352]  ? security_file_ioctl+0x76/0xb0
[ 3009.616754]  ? security_file_ioctl+0x83/0xb0
[ 3009.621145]  SyS_ioctl+0x7f/0xb0
[ 3009.624580]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3009.628552]  do_syscall_64+0x1d5/0x640
[ 3009.632520]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3009.637740] RIP: 0033:0x45ca59
[ 3009.640925] RSP: 002b:00007efcb6a30c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3009.648710] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3009.656058] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007
[ 3009.663392] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
[ 3009.670660] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3009.678006] R13: 000000000000020e R14: 00000000004c4557 R15: 00007efcb6a316d4
[ 3009.685366] INFO: task syz-executor.3:2483 blocked for more than 140 seconds.
[ 3009.692727]       Not tainted 4.14.184-syzkaller #0
[ 3009.697751] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3009.705903] syz-executor.3  D28992  2483   6360 0x00000004
[ 3009.711599] Call Trace:
[ 3009.714187]  __schedule+0x8a6/0x1d70
[ 3009.717885]  ? firmware_map_remove+0x18f/0x18f
[ 3009.722531]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.726680]  schedule+0x8d/0x1b0
[ 3009.730024]  schedule_preempt_disabled+0xf/0x20
[ 3009.734736]  __mutex_lock+0x5f0/0x1430
[ 3009.738619]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.742943]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.748391]  ? __might_fault+0x104/0x1b0
[ 3009.752522]  ? lock_acquire+0x170/0x3f0
[ 3009.756505]  ? ctrl_cdev_ioctl+0x142/0x220
[ 3009.760724]  ctrl_cdev_ioctl+0x142/0x220
[ 3009.764860]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.769443]  ? selinux_file_ioctl+0x3f7/0x560
[ 3009.773983]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.778616]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.782485]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.788131]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.793326]  ? security_file_ioctl+0x76/0xb0
[ 3009.797794]  ? security_file_ioctl+0x83/0xb0
[ 3009.804541]  SyS_ioctl+0x7f/0xb0
[ 3009.807901]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3009.811912]  do_syscall_64+0x1d5/0x640
[ 3009.815798]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3009.820965] RIP: 0033:0x45ca59
[ 3009.825322] RSP: 002b:00007fd5df2dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3009.833132] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3009.840387] RDX: 000000000076006e RSI: 0000000040046f41 RDI: 0000000000000005
[ 3009.847815] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 3009.855145] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3009.862457] R13: 000000000000020e R14: 00000000004c4557 R15: 00007fd5df2dd6d4
[ 3009.869771] INFO: task syz-executor.3:2486 blocked for more than 140 seconds.
[ 3009.877136]       Not tainted 4.14.184-syzkaller #0
[ 3009.882217] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 3009.890174] syz-executor.3  D28960  2486   6360 0x00000004
[ 3009.895847] Call Trace:
[ 3009.898429]  __schedule+0x8a6/0x1d70
[ 3009.902199]  ? firmware_map_remove+0x18f/0x18f
[ 3009.906789]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.910919]  schedule+0x8d/0x1b0
[ 3009.914484]  schedule_preempt_disabled+0xf/0x20
[ 3009.919146]  __mutex_lock+0x5f0/0x1430
[ 3009.923083]  ? lock_downgrade+0x6e0/0x6e0
[ 3009.927222]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.932755]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3009.936984]  ? __mutex_unlock_slowpath+0x75/0x780
[ 3009.941961]  ? __ww_mutex_wakeup_for_backoff+0x210/0x210
[ 3009.947418]  ? __get_mtd_device+0x130/0x130
[ 3009.951790]  ? __might_fault+0x177/0x1b0
[ 3009.955855]  ? ctrl_cdev_ioctl+0x190/0x220
[ 3009.960076]  ctrl_cdev_ioctl+0x190/0x220
[ 3009.964192]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.968808]  ? selinux_file_ioctl+0x3f7/0x560
[ 3009.973360]  ? ubi_cdev_compat_ioctl+0x30/0x30
[ 3009.977952]  do_vfs_ioctl+0x75a/0xfe0
[ 3009.981800]  ? selinux_parse_skb.constprop.0+0x16c0/0x16c0
[ 3009.987419]  ? ioctl_preallocate+0x1a0/0x1a0
[ 3009.991911]  ? security_file_ioctl+0x76/0xb0
[ 3009.996328]  ? security_file_ioctl+0x83/0xb0
[ 3010.000740]  SyS_ioctl+0x7f/0xb0
[ 3010.004161]  ? do_vfs_ioctl+0xfe0/0xfe0
[ 3010.008150]  do_syscall_64+0x1d5/0x640
[ 3010.012138]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3010.017340] RIP: 0033:0x45ca59
[ 3010.020506] RSP: 002b:00007fd5df2bbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3010.028287] RAX: ffffffffffffffda RBX: 00000000004e1620 RCX: 000000000045ca59
[ 3010.035719] RDX: 000000000076006e RSI: 0000000040186f40 RDI: 0000000000000007
[ 3010.043026] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000
[ 3010.050287] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 3010.057617] R13: 000000000000020e R14: 00000000004c4557 R15: 00007fd5df2bc6d4
[ 3010.065093] 
[ 3010.065093] Showing all locks held in the system:
[ 3010.071412] 1 lock held by khungtaskd/1056:
[ 3010.076024]  #0:  (tasklist_lock){.+.+}, at: [<ffffffff8146c8d0>] debug_show_all_locks+0x7c/0x21a
[ 3010.085189] 1 lock held by in:imklog/6017:
[ 3010.089408]  #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff8191e4e6>] __fdget_pos+0xa6/0xc0
[ 3010.097820] 1 lock held by syz-executor.4/2446:
[ 3010.102550]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.111683] 1 lock held by syz-executor.4/2452:
[ 3010.116331]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220
[ 3010.125416] 1 lock held by syz-executor.5/2451:
[ 3010.130070]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.139152] 1 lock held by syz-executor.5/2457:
[ 3010.143901]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220
[ 3010.153003] 1 lock held by syz-executor.0/2464:
[ 3010.157654]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.166763] 1 lock held by syz-executor.1/2465:
[ 3010.171420]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.180519] 1 lock held by syz-executor.2/2474:
[ 3010.185245]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.194355] 1 lock held by syz-executor.2/2478:
[ 3010.199011]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220
[ 3010.208116] 1 lock held by syz-executor.3/2483:
[ 3010.212854]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe562>] ctrl_cdev_ioctl+0x142/0x220
[ 3010.221934] 1 lock held by syz-executor.3/2486:
[ 3010.226585]  #0:  (ubi_devices_mutex){+.+.}, at: [<ffffffff83cbe5b0>] ctrl_cdev_ioctl+0x190/0x220
[ 3010.235708] 
[ 3010.237322] =============================================
[ 3010.237322] 
[ 3010.244702] NMI backtrace for cpu 1
[ 3010.248325] CPU: 1 PID: 1056 Comm: khungtaskd Not tainted 4.14.184-syzkaller #0
[ 3010.255761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3010.265111] Call Trace:
[ 3010.267685]  dump_stack+0x1b2/0x283
[ 3010.271310]  nmi_cpu_backtrace.cold+0x57/0x93
[ 3010.275812]  ? irq_force_complete_move.cold+0x7b/0x7b
[ 3010.280991]  nmi_trigger_cpumask_backtrace+0x13a/0x17f
[ 3010.286253]  watchdog+0x5e2/0xb80
[ 3010.289714]  ? hungtask_pm_notify+0x50/0x50
[ 3010.294016]  kthread+0x30d/0x420
[ 3010.297370]  ? kthread_create_on_node+0xd0/0xd0
[ 3010.302228]  ret_from_fork+0x24/0x30
[ 3010.306041] Sending NMI from CPU 1 to CPUs 0:
[ 3010.310902] NMI backtrace for cpu 0
[ 3010.310906] CPU: 0 PID: 6023 Comm: rs:main Q:Reg Not tainted 4.14.184-syzkaller #0
[ 3010.310910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3010.310912] task: ffff8880a04aa5c0 task.stack: ffff888089740000
[ 3010.310915] RIP: 0010:__sanitizer_cov_trace_pc+0x15/0x50
[ 3010.310917] RSP: 0018:ffff8880897478c0 EFLAGS: 00000086
[ 3010.310922] RAX: ffff8880a04aa5c0 RBX: ffff8880aec2b580 RCX: 1ffffffff0fe794c
[ 3010.310925] RDX: 0000000080000003 RSI: ffff8880a04aae70 RDI: ffff8880a04aae44
[ 3010.310928] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000a0012
[ 3010.310930] R10: ffff8880a04aae70 R11: ffff8880a04aa5c0 R12: 0000000000000000
[ 3010.310933] R13: ffff8880aec2b580 R14: ffff8880897479b0 R15: ffff8880a04aa5c0
[ 3010.310936] FS:  00007fad29090700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
[ 3010.310939] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3010.310942] CR2: 00007fad20022000 CR3: 00000000a5ec8000 CR4: 00000000001406f0
[ 3010.310945] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3010.310948] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3010.310949] Call Trace:
[ 3010.310951]  debug_smp_processor_id+0x5/0x20
[ 3010.310953]  rcu_is_watching+0x11/0xb0
[ 3010.310955]  __update_idle_core+0x30b/0x3e0
[ 3010.310957]  pick_next_task_idle+0x8f/0xf0
[ 3010.310959]  __schedule+0x14ac/0x1d70
[ 3010.310961]  ? futex_wait_queue_me+0x1d7/0x590
[ 3010.310963]  ? firmware_map_remove+0x18f/0x18f
[ 3010.310965]  ? lock_downgrade+0x6e0/0x6e0
[ 3010.310967]  ? plist_add+0x2d1/0x490
[ 3010.310969]  schedule+0x8d/0x1b0
[ 3010.310971]  futex_wait_queue_me+0x2e0/0x590
[ 3010.310973]  ? mark_wake_futex+0x120/0x120
[ 3010.310975]  ? check_preemption_disabled+0x35/0x240
[ 3010.310977]  futex_wait+0x1ba/0x540
[ 3010.310979]  ? futex_wait_setup+0x2c0/0x2c0
[ 3010.310981]  ? __mnt_drop_write+0x40/0x70
[ 3010.310983]  ? ext4_file_write_iter+0x295/0xd90
[ 3010.310985]  ? up_write+0x17/0x60
[ 3010.310987]  do_futex+0x129/0x1850
[ 3010.310989]  ? trace_hardirqs_on+0x10/0x10
[ 3010.310991]  ? iov_iter_init+0xa6/0x1c0
[ 3010.310993]  ? futex_exit_release+0x60/0x60
[ 3010.310995]  ? fsnotify+0x897/0x1110
[ 3010.310997]  ? __vfs_write+0xec/0x630
[ 3010.310999]  ? SyS_write+0x1b7/0x210
[ 3010.311001]  ? lock_downgrade+0x6e0/0x6e0
[ 3010.311003]  ? __mutex_unlock_slowpath+0x75/0x780
[ 3010.311005]  SyS_futex+0x1e8/0x2d0
[ 3010.311007]  ? fput+0xb/0x140
[ 3010.311009]  ? do_futex+0x1850/0x1850
[ 3010.311011]  ? SyS_read+0x210/0x210
[ 3010.311013]  ? __do_page_fault+0x19a/0xb50
[ 3010.311015]  ? do_syscall_64+0x4c/0x640
[ 3010.311017]  ? do_futex+0x1850/0x1850
[ 3010.311019]  do_syscall_64+0x1d5/0x640
[ 3010.311021]  entry_SYSCALL_64_after_hwframe+0x46/0xbb
[ 3010.311023] RIP: 0033:0x7fad2bad117f
[ 3010.311025] RSP: 002b:00007fad2908fc70 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 3010.311030] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fad2bad117f
[ 3010.311033] RDX: 0000000000004aa9 RSI: 0000000000000080 RDI: 000055d27d0f628c
[ 3010.311036] RBP: 000055d27d0f6288 R08: 000055d27d0f6000 R09: 0000000000002554
[ 3010.311039] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fad2908fcd0
[ 3010.311042] R13: 0000000000000000 R14: 000055d27b7c5290 R15: 0000000000000000
[ 3010.311043] Code: e8 9c de ee ff 48 c7 05 26 f2 dd 08 00 00 00 00 e9 be ed ff ff 90 65 48 8b 04 25 40 ee 01 00 48 85 c0 74 1a 65 8b 15 db 47 a7 7e <81> e2 00 01 1f 00 75 0b 8b 90 58 13 00 00 83 fa 01 74 01 c3 48 
[ 3010.311563] Kernel panic - not syncing: hung_task: blocked tasks
[ 3010.641950] CPU: 1 PID: 1056 Comm: khungtaskd Not tainted 4.14.184-syzkaller #0
[ 3010.649512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3010.658842] Call Trace:
[ 3010.661415]  dump_stack+0x1b2/0x283
[ 3010.665031]  panic+0x1f9/0x42d
[ 3010.668211]  ? add_taint.cold+0x16/0x16
[ 3010.672161]  ? irq_force_complete_move.cold+0x7b/0x7b
[ 3010.677337]  watchdog+0x5f3/0xb80
[ 3010.680766]  ? hungtask_pm_notify+0x50/0x50
[ 3010.685063]  kthread+0x30d/0x420
[ 3010.688416]  ? kthread_create_on_node+0xd0/0xd0
[ 3010.693065]  ret_from_fork+0x24/0x30
[ 3010.698304] Kernel Offset: disabled
[ 3010.701932] Rebooting in 86400 seconds..