Extracting prog: 2h29m28.014982714s Minimizing prog: 1h22m31.642638408s Simplifying prog options: 0s Extracting C: 2m46.934031569s Simplifying C: 17m28.790007807s extracting reproducer from 57 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) program did not crash single: failed to extract reproducer bisect: bisecting 57 programs with base timeout 30s testing program (duration=44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 17, 25, 5, 5, 6, 13, 5, 5, 16, 25, 5, 6, 4, 6, 13, 4, 4, 2, 4, 5, 5, 4, 4, 4, 13, 7, 4, 7, 3, 4, 4, 13, 8, 9, 18, 4, 6, 11, 4, 14, 13, 6, 9, 16, 11, 8, 9, 2, 3, 12, 7, 4, 11, 5, 4, 7] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nodev\x00', &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/current_tracer\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='nop', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./trace/trace_options\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='bin', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001f0)='./trace/trace_marker\x00', 0x1, 0x0) write(r2, &(0x7f00000001f8)='hello', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/trace_pipe\x00', 0x800, 0x0) read(r3, &(0x7f0000000300), 0x1000) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./trace/trace\x00', 0x0, 0x0) read(r4, &(0x7f0000000500), 0x1000) close(r4) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) close(r2) nanosleep(&(0x7f0000000440)={0x0, 0x5f5e100}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x16, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='\n\x00', 0x1) close(r4) executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r0, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000082, 0x0, 0x1}]}) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x4004ae94, &(0x7f0000001000)) ioctl$KVM_GET_XSAVE(r2, 0x8004ae94, &(0x7f0000002000)) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/1/msr\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000300)="000ceefe00000000", 0x8, 0x1b) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r1, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000082, 0x0, 0x1}]}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 33: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) close(r2) nanosleep(&(0x7f0000000440)={0x0, 0x5f5e100}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x16, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='\n\x00', 0x1) close(r4) executing program 34: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x65, 0x20, {0x1b, 0x200900}}, @code={0xa, 0x21, {"48b82000200000000000c70078563412"}}], 0x41}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev_mnt\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd06, &(0x7f0000030000)="04000000000000000000000038010000380100000000000000000000020000000000000000000000000000006d795f63") executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/1/msr\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000300)="000ceefe00000000", 0x8, 0x1b) executing program 4: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='3,0x7f0000800000,0x7f0', 0x16) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ab0701fc00000000000109022000010100000009040000020803f1000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 5: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f00000001c0)={[{@grpquota}, {@usrquota}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") quotactl$Q_QUOTAON(0x80000202, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x2, &(0x7f0000000200)='aquota.project\x00') quotactl$Q_GETQUOTA(0x80000700, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000300)) quotactl$Q_GETINFO(0x80000500, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000400)) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x10000, 0x3}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x28011, r2, 0x0) write(0x1, &(0x7f0000000000)='\x00', 0x1) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd020308", 0x83) executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='acpi-nfit\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ACPI0012:00/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='acpi-nfit\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/acpi-nfit/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='alarmtimer\x00', 0xb) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='freeze \n', 0x8) executing program 6: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x1}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001100)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r10, 0x0, &(0x7f0000001200)=[{&(0x7f0000005000), 0x1000}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) executing program 6: r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='/dev/char/188:0\x00', 0x10) read(r0, &(0x7f0000000000), 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/kvm/parameters/force_emulation_prefix\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1\n', 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000300)={0x0, &(0x7f0000000400)=[@code={0xa, 0x18, {"0f0b6b766d480fc8"}}, @uexit={0x0, 0x10, 0xface}], 0x28}) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaeaba, 0x27ac40) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:5555\x00', 0x48) executing program 9: r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x24, {"4831c048bf0000500000000000660f388207c3"}}], 0x24}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000100)={0x64, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0fc5:1227:b\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='auto\n', 0x5) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r3, &(0x7f0000000480)='on\n', 0x3) close(r3) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 9: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) executing program 6: mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mkdir(&(0x7f0000000100)='./mnt_nfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='+tcp 2049\n', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='1\n', 0x2) close(r1) executing program 6: syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020200406d041fc100000102030109024b00010100c0320904000003020a0000152412000174f03dbd1ec14470a3677134c9f554370724130100010000090583030800080000090581024000000000090502024000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x1, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @random="d8be17d19221", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x40, 0x11, 0x0, @local, @remote}, {0x1234, 0x1234, 0x8}}}}}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000e0)='\a\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='file0\x00', 0x42, 0x1ff) pwrite64(r2, &(0x7f0000000200)="0000ffff1000000000010000", 0xc, 0xb0) pwrite64(r2, &(0x7f0000000300)="4349535300000000060100000200000000000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000040000000000000000000000020000000", 0x58, 0x100) pwrite64(r2, &(0x7f0000000400)="1000000000000000", 0x8, 0x1b4) lseek(r2, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/512, 0x200) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'lo\x00', &(0x7f0000000300)=@ethtool_drvinfo}) executing program 9: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) poll(0x0, 0x0, 0x3e8) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0xb, 0x2) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, &(0x7f0000000100)={0x1}) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/disk\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='platform\x00', 0x8) close(r0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd0203080070780100"/197, 0xc5) executing program 7: syz_usb_connect(0x2, 0x58, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba230100000101020301090250000201008032090400000001010000092401000109000101090401000001020000090401020101020000072401010101000b2402010201080180380007050105400001"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000200)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000400)={0x0, [[0xff], [0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff]], '\x00', [{0x1, 0x40}, {0x1, 0x400}, {0x1, 0x8}, {0x1f40, 0x2ee00}, {0x1, 0xf4240}, {0x1, 0x400}, {0x1, 0x10000}, {0x1, 0x400}, {0x1, 0xf4240}, {0x1, 0x10000}, {0x1, 0x100000}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) write$snddsp(r0, &(0x7f0000000500)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) program did not crash single: failed to extract reproducer bisect: bisecting 57 programs with base timeout 1m40s testing program (duration=1m54s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 17, 25, 5, 5, 6, 13, 5, 5, 16, 25, 5, 6, 4, 6, 13, 4, 4, 2, 4, 5, 5, 4, 4, 4, 13, 7, 4, 7, 3, 4, 4, 13, 8, 9, 18, 4, 6, 11, 4, 14, 13, 6, 9, 16, 11, 8, 9, 2, 3, 12, 7, 4, 11, 5, 4, 7] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nodev\x00', &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/current_tracer\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='nop', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./trace/trace_options\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='bin', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001f0)='./trace/trace_marker\x00', 0x1, 0x0) write(r2, &(0x7f00000001f8)='hello', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/trace_pipe\x00', 0x800, 0x0) read(r3, &(0x7f0000000300), 0x1000) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./trace/trace\x00', 0x0, 0x0) read(r4, &(0x7f0000000500), 0x1000) close(r4) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) close(r2) nanosleep(&(0x7f0000000440)={0x0, 0x5f5e100}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x16, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='\n\x00', 0x1) close(r4) executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r0, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000082, 0x0, 0x1}]}) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x4004ae94, &(0x7f0000001000)) ioctl$KVM_GET_XSAVE(r2, 0x8004ae94, &(0x7f0000002000)) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/1/msr\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000300)="000ceefe00000000", 0x8, 0x1b) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r1, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000082, 0x0, 0x1}]}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 33: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) close(r2) nanosleep(&(0x7f0000000440)={0x0, 0x5f5e100}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x16, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000540)) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='\n\x00', 0x1) close(r4) executing program 34: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x2, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x65, 0x20, {0x1b, 0x200900}}, @code={0xa, 0x21, {"48b82000200000000000c70078563412"}}], 0x41}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev_mnt\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd06, &(0x7f0000030000)="04000000000000000000000038010000380100000000000000000000020000000000000000000000000000006d795f63") executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/1/msr\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000300)="000ceefe00000000", 0x8, 0x1b) executing program 4: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='3,0x7f0000800000,0x7f0', 0x16) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ab0701fc00000000000109022000010100000009040000020803f1000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 5: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f00000001c0)={[{@grpquota}, {@usrquota}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") quotactl$Q_QUOTAON(0x80000202, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x2, &(0x7f0000000200)='aquota.project\x00') quotactl$Q_GETQUOTA(0x80000700, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000300)) quotactl$Q_GETINFO(0x80000500, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000400)) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x10000, 0x3}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x28011, r2, 0x0) write(0x1, &(0x7f0000000000)='\x00', 0x1) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd020308", 0x83) executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='acpi-nfit\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ACPI0012:00/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='acpi-nfit\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/acpi-nfit/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='alarmtimer\x00', 0xb) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='freeze \n', 0x8) executing program 6: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x1}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001100)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r10, 0x0, &(0x7f0000001200)=[{&(0x7f0000005000), 0x1000}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) executing program 6: r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='/dev/char/188:0\x00', 0x10) read(r0, &(0x7f0000000000), 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/kvm/parameters/force_emulation_prefix\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1\n', 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000300)={0x0, &(0x7f0000000400)=[@code={0xa, 0x18, {"0f0b6b766d480fc8"}}, @uexit={0x0, 0x10, 0xface}], 0x28}) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaeaba, 0x27ac40) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:5555\x00', 0x48) executing program 9: r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x24, {"4831c048bf0000500000000000660f388207c3"}}], 0x24}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000100)={0x64, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0fc5:1227:b\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='auto\n', 0x5) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r3, &(0x7f0000000480)='on\n', 0x3) close(r3) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 9: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) executing program 6: mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mkdir(&(0x7f0000000100)='./mnt_nfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='+tcp 2049\n', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='1\n', 0x2) close(r1) executing program 6: syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020200406d041fc100000102030109024b00010100c0320904000003020a0000152412000174f03dbd1ec14470a3677134c9f554370724130100010000090583030800080000090581024000000000090502024000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x1, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @random="d8be17d19221", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x40, 0x11, 0x0, @local, @remote}, {0x1234, 0x1234, 0x8}}}}}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000e0)='\a\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='file0\x00', 0x42, 0x1ff) pwrite64(r2, &(0x7f0000000200)="0000ffff1000000000010000", 0xc, 0xb0) pwrite64(r2, &(0x7f0000000300)="4349535300000000060100000200000000000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000040000000000000000000000020000000", 0x58, 0x100) pwrite64(r2, &(0x7f0000000400)="1000000000000000", 0x8, 0x1b4) lseek(r2, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/512, 0x200) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'lo\x00', &(0x7f0000000300)=@ethtool_drvinfo}) executing program 9: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) poll(0x0, 0x0, 0x3e8) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0xb, 0x2) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, &(0x7f0000000100)={0x1}) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/disk\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='platform\x00', 0x8) close(r0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd0203080070780100"/197, 0xc5) executing program 7: syz_usb_connect(0x2, 0x58, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba230100000101020301090250000201008032090400000001010000092401000109000101090401000001020000090401020101020000072401010101000b2402010201080180380007050105400001"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000200)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000400)={0x0, [[0xff], [0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff]], '\x00', [{0x1, 0x40}, {0x1, 0x400}, {0x1, 0x8}, {0x1f40, 0x2ee00}, {0x1, 0xf4240}, {0x1, 0x400}, {0x1, 0x10000}, {0x1, 0x400}, {0x1, 0xf4240}, {0x1, 0x10000}, {0x1, 0x100000}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) write$snddsp(r0, &(0x7f0000000500)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) program crashed: WARNING: still has locks held in __fdget_pos bisect: bisecting 57 programs bisect: split chunks (needed=false): <55> bisect: split chunk #0 of len 55 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m49s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4, 4, 4, 13, 7, 4, 7, 3, 4, 4, 13, 8, 9, 18, 4, 6, 11, 4, 14, 13, 6, 9, 16, 11, 8, 9, 2, 3, 12, 7, 4, 11, 5, 4, 7] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd020308", 0x83) executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='acpi-nfit\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ACPI0012:00/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='acpi-nfit\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/acpi-nfit/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='alarmtimer\x00', 0xb) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='freeze \n', 0x8) executing program 6: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x1}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001100)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r10, 0x0, &(0x7f0000001200)=[{&(0x7f0000005000), 0x1000}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) executing program 6: r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='/dev/char/188:0\x00', 0x10) read(r0, &(0x7f0000000000), 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/kvm/parameters/force_emulation_prefix\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1\n', 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000300)={0x0, &(0x7f0000000400)=[@code={0xa, 0x18, {"0f0b6b766d480fc8"}}, @uexit={0x0, 0x10, 0xface}], 0x28}) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaeaba, 0x27ac40) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:5555\x00', 0x48) executing program 9: r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x24, {"4831c048bf0000500000000000660f388207c3"}}], 0x24}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000100)={0x64, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0fc5:1227:b\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='auto\n', 0x5) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r3, &(0x7f0000000480)='on\n', 0x3) close(r3) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 9: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) executing program 6: mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mkdir(&(0x7f0000000100)='./mnt_nfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='+tcp 2049\n', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='1\n', 0x2) close(r1) executing program 6: syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020200406d041fc100000102030109024b00010100c0320904000003020a0000152412000174f03dbd1ec14470a3677134c9f554370724130100010000090583030800080000090581024000000000090502024000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x1, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @random="d8be17d19221", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x40, 0x11, 0x0, @local, @remote}, {0x1234, 0x1234, 0x8}}}}}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000e0)='\a\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='file0\x00', 0x42, 0x1ff) pwrite64(r2, &(0x7f0000000200)="0000ffff1000000000010000", 0xc, 0xb0) pwrite64(r2, &(0x7f0000000300)="4349535300000000060100000200000000000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000040000000000000000000000020000000", 0x58, 0x100) pwrite64(r2, &(0x7f0000000400)="1000000000000000", 0x8, 0x1b4) lseek(r2, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/512, 0x200) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'lo\x00', &(0x7f0000000300)=@ethtool_drvinfo}) executing program 9: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) poll(0x0, 0x0, 0x3e8) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0xb, 0x2) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, &(0x7f0000000100)={0x1}) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/disk\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='platform\x00', 0x8) close(r0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd0203080070780100"/197, 0xc5) executing program 7: syz_usb_connect(0x2, 0x58, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba230100000101020301090250000201008032090400000001010000092401000109000101090401000001020000090401020101020000072401010101000b2402010201080180380007050105400001"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000200)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000400)={0x0, [[0xff], [0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff]], '\x00', [{0x1, 0x40}, {0x1, 0x400}, {0x1, 0x8}, {0x1f40, 0x2ee00}, {0x1, 0xf4240}, {0x1, 0x400}, {0x1, 0x10000}, {0x1, 0x400}, {0x1, 0xf4240}, {0x1, 0x10000}, {0x1, 0x100000}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) write$snddsp(r0, &(0x7f0000000500)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 14, 13, 6, 9, 16, 11, 8, 9, 2, 3, 12, 7, 4, 11, 5, 4, 7] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/kvm/parameters/force_emulation_prefix\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1\n', 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000300)={0x0, &(0x7f0000000400)=[@code={0xa, 0x18, {"0f0b6b766d480fc8"}}, @uexit={0x0, 0x10, 0xface}], 0x28}) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaeaba, 0x27ac40) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:5555\x00', 0x48) executing program 9: r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x24, {"4831c048bf0000500000000000660f388207c3"}}], 0x24}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000100)={0x64, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 9: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0fc5:1227:b\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='auto\n', 0x5) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r3, &(0x7f0000000480)='on\n', 0x3) close(r3) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 9: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) executing program 6: mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mkdir(&(0x7f0000000100)='./mnt_nfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='+tcp 2049\n', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='1\n', 0x2) close(r1) executing program 6: syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020200406d041fc100000102030109024b00010100c0320904000003020a0000152412000174f03dbd1ec14470a3677134c9f554370724130100010000090583030800080000090581024000000000090502024000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x1, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @random="d8be17d19221", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x40, 0x11, 0x0, @local, @remote}, {0x1234, 0x1234, 0x8}}}}}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000e0)='\a\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='file0\x00', 0x42, 0x1ff) pwrite64(r2, &(0x7f0000000200)="0000ffff1000000000010000", 0xc, 0xb0) pwrite64(r2, &(0x7f0000000300)="4349535300000000060100000200000000000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000040000000000000000000000020000000", 0x58, 0x100) pwrite64(r2, &(0x7f0000000400)="1000000000000000", 0x8, 0x1b4) lseek(r2, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/512, 0x200) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'lo\x00', &(0x7f0000000300)=@ethtool_drvinfo}) executing program 9: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) poll(0x0, 0x0, 0x3e8) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0xb, 0x2) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, &(0x7f0000000100)={0x1}) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/disk\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='platform\x00', 0x8) close(r0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd0203080070780100"/197, 0xc5) executing program 7: syz_usb_connect(0x2, 0x58, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba230100000101020301090250000201008032090400000001010000092401000109000101090401000001020000090401020101020000072401010101000b2402010201080180380007050105400001"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000200)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000400)={0x0, [[0xff], [0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff]], '\x00', [{0x1, 0x40}, {0x1, 0x400}, {0x1, 0x8}, {0x1f40, 0x2ee00}, {0x1, 0xf4240}, {0x1, 0x400}, {0x1, 0x10000}, {0x1, 0x400}, {0x1, 0xf4240}, {0x1, 0x10000}, {0x1, 0x100000}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) write$snddsp(r0, &(0x7f0000000500)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4, 4, 4, 13, 7, 4, 7, 3, 4, 4, 13, 8, 9, 18, 4, 6, 11, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd020308", 0x83) executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='acpi-nfit\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ACPI0012:00/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='acpi-nfit\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/acpi-nfit/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='alarmtimer\x00', 0xb) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='freeze \n', 0x8) executing program 6: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x1}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001100)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r10, 0x0, &(0x7f0000001200)=[{&(0x7f0000005000), 0x1000}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) executing program 6: r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='/dev/char/188:0\x00', 0x10) read(r0, &(0x7f0000000000), 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: split chunks (needed=true): <19> bisect: split chunk #0 of len 19 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 4, 13, 8, 9, 18, 4, 6, 11, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="00ffffffffffff000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001fd020308", 0x83) executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='acpi-nfit\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ACPI0012:00/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='acpi-nfit\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/acpi-nfit/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='alarmtimer\x00', 0xb) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='freezer\n', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='freeze \n', 0x8) executing program 6: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x1}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001100)=@IORING_OP_READV_FIXED={0x3c, 0x0, 0x0, @fd=r10, 0x0, &(0x7f0000001200)=[{&(0x7f0000005000), 0x1000}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) executing program 6: r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x1}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180), 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/level\x00', 0x1, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='none\x00', 0x4) executing program 1: pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f0000000300)='/dev/char/188:0\x00', 0x10) read(r0, &(0x7f0000000000), 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4, 4, 4, 13, 7, 4, 7, 3, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 7, 4, 7, 3, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 8: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 36: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 37: syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280), 0x1, 0x1a2, &(0x7f0000000a40)="$eJzs0L9rE2Ecx/H397nLjwpVouJQwQYsnheqyV3VwSk4RciBg4tg0JDGppio6WWwpYUuUpBq/wWd6qiCTiIKzsVBcNBz6Sa9oTiIg0Tu8kTwb/B5wd3nvh+453l4OmE/zAG/91dbVElZHOQjgg1My6hTapSv9fxd59YouKTnTZ3PdE6Fyyu3m91ue6l4sUjhnwL4kXZ/q/AFxxSxUEU+76+2mnIzYFilp+YDCnVKj7Aa9N3HTNmTHL2BxdDZ5LKiL04dDpUHvXvlcHnlzGKvudBeaN/x/bkLlXOVynm/fGux2668QtyHonjCGm5ALmDCXSPT4MGOfYBZQdyOiiwpxWQbbO1Yp0/Oxih3jyHCOycm99XuFNVVTpG/nhy+xhHhKVbATJ0JhU26UQ25ol6KZ3+yf2YU+XXLOtu6253fuKbkV3a7Knt58XbJOB5+yWMuuRoO856NiJmIWsR2xO43puVNssv4Xu315P1cT8c5AVnuNweDJS8LH8QJ8JOnAJPpcio9VwHe6n908GX8YRiGYRiGYRiGYfwH/gQAAP//lKZkGA==") mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='file0\x00', &(0x7f0000000300)='tmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='file0/mysys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='file0/mysys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0/mysys/power/pm_test\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='devices', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000a00)='file0/mysys/power/state\x00', 0x1, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000405205a1a4000000000001090212000101008000090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 1: syz_usb_connect(0x1, 0x79, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d000001010203010902670004010080100904000000ff0000000904010000ff0000000904010101ff0000000b2402010102100144ac000905810540000100000904020000ff0000000904020101ff0000000b2402010102100144ac000905020540000100000904030000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4, 4, 4, 13] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 4, 13] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000040405e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/infiniband_srp/srp-syz1-1/add_target\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x1, 0x0) write(r2, &(0x7f00000005c0)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/infiniband_srp/srp-syz2-1/add_target\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) write(0xffffffffffffffff, &(0x7f0000000740)='id_ext=0000000000000001,ioc_guid=0000000000000001,dest=127.0.0.1:3260\x00', 0x44) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 5, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 5: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x2, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 3 programs left: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) bisect: trying to concatenate bisect: concatenate 3 entries minimizing program #0 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 16, 4] detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 4] detailed listing: executing program 0: executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r3) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos minimized 16 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='2-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) close(r2) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='2-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r1) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) close(r0) write(0xffffffffffffffff, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 4] detailed listing: executing program 0: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 4] detailed listing: executing program 0: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 35: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash minimized 16 calls -> 6 calls minimizing program #2 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 3] detailed listing: executing program 0: executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 3] detailed listing: executing program 0: executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 3] detailed listing: executing program 0: executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 3] detailed listing: executing program 0: executing program 32: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) executing program 0: mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash minimized 4 calls -> 4 calls testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-write-mkdirat-mount-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos bisect: concatenation succeeded found reproducer with 10 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-write-mkdirat-mount-openat detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-write-mkdirat-mount-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-write-mkdirat-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-openat-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-close-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos simplifying C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in vfs_write a never seen crash title: WARNING: still has locks held in vfs_write, ignore testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write program crashed: WARNING: still has locks held in __fdget_pos testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos validation run: crashed=true testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos validation run: crashed=true testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/dvb_usb_af9005/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1-1:1.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='mem', 0x3) program crashed: WARNING: still has locks held in __fdget_pos validation run: crashed=true reproducing took 4h18m48.56058623s repro crashed as (corrupted=false): af9005: boot packet bulk message failed: -71 (252/0) dvb-usb: found a 'Afatech DVB-T USB1.1 stick' in cold state, will try to load a firmware usb 1-1: Direct firmware load for af9005.fw failed with error -2 usb 1-1: Falling back to sysfs fallback for: af9005.fw ==================================== WARNING: syz.0.17/4431 still has locks held! syzkaller #0 Not tainted ------------------------------------ 5 locks held by syz.0.17/4431: #0: ffff888077f6afe8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038 #1: ffff88801e730460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580 #2: ffff88807a62e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1d8/0x520 fs/kernfs/file.c:343 #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline] #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1098 [inline] #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xa5/0x1c0 drivers/base/dd.c:1130 #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline] #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1099 [inline] #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xce/0x1c0 drivers/base/dd.c:1130 stack backtrace: CPU: 0 PID: 4431 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 try_to_freeze include/linux/freezer.h:57 [inline] usermodehelper_read_trylock+0x204/0x2b0 kernel/umh.c:234 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:143 [inline] firmware_fallback_sysfs+0x16a/0x950 drivers/base/firmware_loader/fallback.c:234 _request_firmware+0xccb/0x1280 drivers/base/firmware_loader/main.c:884 request_firmware+0x32/0x50 drivers/base/firmware_loader/main.c:933 dvb_usb_download_firmware+0xb2/0x250 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:93 dvb_usb_device_init+0xd26/0x2490 drivers/media/usb/dvb-usb/dvb-usb-init.c:298 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x24a/0xb40 drivers/base/dd.c:638 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804 device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131 bind_store+0x33b/0x380 drivers/base/bus.c:216 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x482/0x9a0 fs/read_write.c:584 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f131199e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f13127bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f1311c25fa0 RCX: 00007f131199e0d9 RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004 RBP: 00007f1311a35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1311c26038 R14: 00007f1311c25fa0 R15: 00007fffde630448 final repro crashed as (corrupted=false): af9005: boot packet bulk message failed: -71 (252/0) dvb-usb: found a 'Afatech DVB-T USB1.1 stick' in cold state, will try to load a firmware usb 1-1: Direct firmware load for af9005.fw failed with error -2 usb 1-1: Falling back to sysfs fallback for: af9005.fw ==================================== WARNING: syz.0.17/4431 still has locks held! syzkaller #0 Not tainted ------------------------------------ 5 locks held by syz.0.17/4431: #0: ffff888077f6afe8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038 #1: ffff88801e730460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580 #2: ffff88807a62e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1d8/0x520 fs/kernfs/file.c:343 #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline] #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1098 [inline] #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xa5/0x1c0 drivers/base/dd.c:1130 #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline] #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1099 [inline] #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xce/0x1c0 drivers/base/dd.c:1130 stack backtrace: CPU: 0 PID: 4431 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 try_to_freeze include/linux/freezer.h:57 [inline] usermodehelper_read_trylock+0x204/0x2b0 kernel/umh.c:234 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:143 [inline] firmware_fallback_sysfs+0x16a/0x950 drivers/base/firmware_loader/fallback.c:234 _request_firmware+0xccb/0x1280 drivers/base/firmware_loader/main.c:884 request_firmware+0x32/0x50 drivers/base/firmware_loader/main.c:933 dvb_usb_download_firmware+0xb2/0x250 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:93 dvb_usb_device_init+0xd26/0x2490 drivers/media/usb/dvb-usb/dvb-usb-init.c:298 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x24a/0xb40 drivers/base/dd.c:638 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804 device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131 bind_store+0x33b/0x380 drivers/base/bus.c:216 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x482/0x9a0 fs/read_write.c:584 ksys_write+0x14d/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f131199e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f13127bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f1311c25fa0 RCX: 00007f131199e0d9 RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004 RBP: 00007f1311a35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1311c26038 R14: 00007f1311c25fa0 R15: 00007fffde630448