Extracting prog: 16m58.069286132s
Minimizing prog: 50m40.930542394s
Simplifying prog options: 13m7.380708562s
Extracting C: 2m40.191641683s
Simplifying C: 0s


extracting reproducer from 14 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-ioctl$KVM_GET_VCPU_MMAP_SIZE-mmap$KVM_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_PRE_FAULT_MEMORY-ioctl$KVM_SET_USER_MEMORY_REGION
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@uexit={0x0, 0x18, 0xaaaa}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2710, 0x0, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000140)={0x8000000, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x1, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$IPCTNL_MSG_EXP_NEW-write$uinput_user_dev-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-sendmsg$ETHTOOL_MSG_RINGS_SET-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN
detailed listing:
executing program 0:
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xfc, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}]}]}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x40810}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_TX={0x8}]}, 0x1c}}, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='disk\x00\x00\x00\x00\x00\x00\x00\x00', 0x4)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-close-ioctl$HIDIOCGUCODE-syz_mount_image$hfsplus-getpgrp-sched_setaffinity-gettid-timer_create-fcntl$lock-mprotect-timer_settime-mmap-userfaultfd-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-timer_create-fcntl$lock-mprotect-timer_settime-mmap-socket$alg-bind$alg
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x24}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00224102000083000400000b11200000b3"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
close(0x3)
ioctl$HIDIOCGUCODE(r2, 0xc018480d, 0x0)
syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', 0x8488, &(0x7f0000000340)=ANY=[@ANYBLOB='nobarrier,nls=ascii,part=0x0000000000000000,nodecompose,gid=', @ANYRESHEX=0x0, @ANYBLOB='\x00'/15, @ANYRESHEX=0x0, @ANYRESDEC=0x0], 0x3, 0x72f, &(0x7f0000000dc0)="$eJzs3U1sHGcZAOB3dtdrb4rcbZu0BSHFakQEDSS2l5IgIWGqCvlQQSQuvZrEaays3WC7yIkQcYDCEU4ohx6KkDn0hHpAKuJQUc5ISFyR75F6r3pg0fzsendtr9dxbKfmeaTZ+Wbm+3nn9cy363GiDeD/1uwbMbIeScxeeH0t3d7caDQ3NxqL7XJEjEZEKaKSryJZikg+jpiJfIkvpjuL7pLdxnnl4Yfvnn/wfiPfqhRLVr80qN2W1oAR1oslJiKiXKxjbF+ZqOzW37V4Ne+vy719dZ104k4Tdq6dODhurY6kKK/vp/kQ9y3wpLsXUR7ZYX894lTxVpp+DohidigdcXiP3b5mOQAAAHgylfeq8HREEmsxfjThAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMmQ5N8ZmBRLqV2eiKT9/f/VYl+qWj3meAf7+h7H37lxRIEAAAAAAAAAwKH4oPjD/dlP49NYi/Fs4wsRrST7m/9L2fbp7PWpeDtWYj6W42KsxVysxmosx1TEyHhXh9W1udXV5antLX8factWq3WvaDkdEfVtLad3CbT0+M8dAAAAAAAAAE6gX8RsjB93EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0C2JKOerbDndLtejVImIsYiopvXWI/7WLn+efXTcAQAAAMDhqxXr8eS/eaGVZL/zP5/93j8Wb8dSrMZCrEYz5uN69iwg/62/9K/1RnNzo7GYLts7/t4n+4oj6zEiynF/l5EnsxpnOi1m4/vxo7gQE3E1lmMhfhpzsRrzMRG19CRiLpKo1/KnF/V2nDvHO9OzdbVTauVne7Yv1hezSGpxIxay2C7GtWrkj02yc0jHfLFrtL9UI/pGvJ9mJ/luYcgcXe/6ef2ueC7TjvTpIfs4HPXszEc6GZlMc19k45nBuR94nfxkz5GmotR5BnW6GOGjzY10s3+kds5/vJ+cn8pXY+nLr3tz/rgNeJQ2ssO+/kxMR6m4+iKe78357a88eLa38df+/ferN0tLt27eWLlwiKd0EBN7VegkpT8Tja5MvDD46isy0UwzsT5UJmZip5/H2BAtj0C1yEY2FQ05W76Wlebipa5L8K24HvNxOSZjKq7EZHw7pqPRucLS5UxPXiuNxd6cZPdaafv8VhsQ/LmvdlX6zR6Vj1aal2e68to909WzY8Wemd/GZNfV9+zgq+/+J6/9MC8NOSOl43+pKKdj/LLzjvMk6MlEMTe3o3tucCb+0EpfV5pLt5Zvzt0ecrzzxTq9bd/pnZv/OHzU/e/uB9GOIL1e0hm3km1lOam1r5f02HOdur35qhZ/ccnbFdfZc1vHznSO1WM8FuIHu96p1eIzXE9PxftEeuyF7mP/2Zo5q8Xnm/axnk858VY0s08hffacqgE4YqdePlWtPaz9s/Ze7Ve1m7XXx14dvTL65WqM/KPy1/KfS38qfSd5Od6Ln8f4cUcKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnwcqdu7fmms355U4hxvr3dBVKux/avVDddazBhSjtWWfjqeE6jHrE4LGSolB9hBM8YYVa9O1pf7/RQXv+ICKyQrld6KlTPXDwyZ7XWCkOOESah8eS51YrT2q2p1XeR/NKu9XOdSqxMha35pJK3x33WavVGu3cBWPZj+CzVqu7Ti26bhnghLu0unj70sqdu99YWJx7c/7N+aXpK5evXG58a+qbl24sNOcn89fjjhI4DCt37pZ32L3TNw8DAAAAAAAAAAAAT4jiX/+vPvJ/Zqhs/ReaQm+d6vLKziOfPcKzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD7PZt+IkfVIYmry4mS6vbnRaKZLRL27WmlrlfwsIvk4Yibypadists4rzz88N3zD95v5FuVYsnqlwa1G856scRERJSL9d5Gd+hme3/Xuvpbf6Twks4Zpgk7104cHLf/BQAA//+VIu5E")
r3 = getpgrp(0x0)
sched_setaffinity(r3, 0x0, 0x0)
r4 = gettid()
timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=<r5=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r6 = userfaultfd(0x1)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00'})
sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r8=>0x0)
fcntl$lock(r6, 0x25, &(0x7f0000000040)={0x0, 0x2, 0x5fd12af8, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r8, 0x1, &(0x7f0000000240)={{0x77359400}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r9 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r9, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0x58)

program did not crash
single: failed to extract reproducer
bisect: bisecting 14 programs with base timeout 30s
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 10, 9, 16, 19, 29, 2, 4, 2, 10, 6, 4, 18, 9]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000400000)={0x0, &(0x7f0000401000)=[@uexit={0x0, 0x18, 0xb}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0xf4240)
ioctl(r3, 0x4048aecb, &(0x7f0000600000)="0000000000000000008000"/72)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl(r3, 0x4048aecb, &(0x7f0000600100)="070000000000000001000000ffffffff0100"/72)
executing program 3:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}], 0x18})
write(0x1, &(0x7f0000c04028)="01000000000000000040000000000000", 0x10)
ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000180)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x20}]})
ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r3, 0x4068aea3, &(0x7f0000002280)={0xa3, 0x0, &(0x7f0000000100)})
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000002300)={0x1, 0x0, [{0x40000073, 0x0, 0x3001}]})
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000000200)=@vmx={0x5, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffd, 0x0, 0xfdfffffc}, 0x1c)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup(r2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000580)="2e1221b23bb601c477d3df163e75963d86dd606712e9000d118db0049d28b31c32a790343c", 0x25}, {&(0x7f00000005c0)="0046053cb304538a9927911e00005a", 0xf}, {&(0x7f0000000240)="a43b2eaab4000000000080", 0xb}, {&(0x7f0000000540)="57348a", 0x3}], 0x4)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x12, {"f4", 0x1}}], 0x12})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5)
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@code={0xa, 0x1b, {"c7050000000000000000", 0x1}}], 0x1b})
r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r10, 0x3, 0x11, r9, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r9, 0xaea2, 0x100000)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x24}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00224102000083000400000b11200000b3"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
close(0x3)
ioctl$HIDIOCGUCODE(r2, 0xc018480d, 0x0)
syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', 0x8488, &(0x7f0000000340)=ANY=[@ANYBLOB='nobarrier,nls=ascii,part=0x0000000000000000,nodecompose,gid=', @ANYRESHEX=0x0, @ANYBLOB='\x00'/15, @ANYRESHEX=0x0, @ANYRESDEC=0x0], 0x3, 0x72f, &(0x7f0000000dc0)="$eJzs3U1sHGcZAOB3dtdrb4rcbZu0BSHFakQEDSS2l5IgIWGqCvlQQSQuvZrEaays3WC7yIkQcYDCEU4ohx6KkDn0hHpAKuJQUc5ISFyR75F6r3pg0fzsendtr9dxbKfmeaTZ+Wbm+3nn9cy363GiDeD/1uwbMbIeScxeeH0t3d7caDQ3NxqL7XJEjEZEKaKSryJZikg+jpiJfIkvpjuL7pLdxnnl4Yfvnn/wfiPfqhRLVr80qN2W1oAR1oslJiKiXKxjbF+ZqOzW37V4Ne+vy719dZ104k4Tdq6dODhurY6kKK/vp/kQ9y3wpLsXUR7ZYX894lTxVpp+DohidigdcXiP3b5mOQAAAHgylfeq8HREEmsxfjThAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMmQ5N8ZmBRLqV2eiKT9/f/VYl+qWj3meAf7+h7H37lxRIEAAAAAAAAAwKH4oPjD/dlP49NYi/Fs4wsRrST7m/9L2fbp7PWpeDtWYj6W42KsxVysxmosx1TEyHhXh9W1udXV5antLX8factWq3WvaDkdEfVtLad3CbT0+M8dAAAAAAAAAE6gX8RsjB93EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0C2JKOerbDndLtejVImIsYiopvXWI/7WLn+efXTcAQAAAMDhqxXr8eS/eaGVZL/zP5/93j8Wb8dSrMZCrEYz5uN69iwg/62/9K/1RnNzo7GYLts7/t4n+4oj6zEiynF/l5EnsxpnOi1m4/vxo7gQE3E1lmMhfhpzsRrzMRG19CRiLpKo1/KnF/V2nDvHO9OzdbVTauVne7Yv1hezSGpxIxay2C7GtWrkj02yc0jHfLFrtL9UI/pGvJ9mJ/luYcgcXe/6ef2ueC7TjvTpIfs4HPXszEc6GZlMc19k45nBuR94nfxkz5GmotR5BnW6GOGjzY10s3+kds5/vJ+cn8pXY+nLr3tz/rgNeJQ2ssO+/kxMR6m4+iKe78357a88eLa38df+/ferN0tLt27eWLlwiKd0EBN7VegkpT8Tja5MvDD46isy0UwzsT5UJmZip5/H2BAtj0C1yEY2FQ05W76Wlebipa5L8K24HvNxOSZjKq7EZHw7pqPRucLS5UxPXiuNxd6cZPdaafv8VhsQ/LmvdlX6zR6Vj1aal2e68to909WzY8Wemd/GZNfV9+zgq+/+J6/9MC8NOSOl43+pKKdj/LLzjvMk6MlEMTe3o3tucCb+0EpfV5pLt5Zvzt0ecrzzxTq9bd/pnZv/OHzU/e/uB9GOIL1e0hm3km1lOam1r5f02HOdur35qhZ/ccnbFdfZc1vHznSO1WM8FuIHu96p1eIzXE9PxftEeuyF7mP/2Zo5q8Xnm/axnk858VY0s08hffacqgE4YqdePlWtPaz9s/Ze7Ve1m7XXx14dvTL65WqM/KPy1/KfS38qfSd5Od6Ln8f4cUcKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnwcqdu7fmms355U4hxvr3dBVKux/avVDddazBhSjtWWfjqeE6jHrE4LGSolB9hBM8YYVa9O1pf7/RQXv+ICKyQrld6KlTPXDwyZ7XWCkOOESah8eS51YrT2q2p1XeR/NKu9XOdSqxMha35pJK3x33WavVGu3cBWPZj+CzVqu7Ti26bhnghLu0unj70sqdu99YWJx7c/7N+aXpK5evXG58a+qbl24sNOcn89fjjhI4DCt37pZ32L3TNw8DAAAAAAAAAAAAT4jiX/+vPvJ/Zqhs/ReaQm+d6vLKziOfPcKzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD7PZt+IkfVIYmry4mS6vbnRaKZLRL27WmlrlfwsIvk4Yibypadists4rzz88N3zD95v5FuVYsnqlwa1G856scRERJSL9d5Gd+hme3/Xuvpbf6Twks4Zpgk7104cHLf/BQAA//+VIu5E")
r3 = getpgrp(0x0)
sched_setaffinity(r3, 0x0, 0x0)
r4 = gettid()
timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=<r5=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r6 = userfaultfd(0x1)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00'})
sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r8=>0x0)
fcntl$lock(r6, 0x25, &(0x7f0000000040)={0x0, 0x2, 0x5fd12af8, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r8, 0x1, &(0x7f0000000240)={{0x77359400}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r9 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r9, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./memcg\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./memcg\x00', &(0x7f00000000c0)='cgroup2\x00', 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138aeb4, &(0x7f0000000200)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfee00900})
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_DISABLE_QUIRKS2(r1, 0x4068aea3, &(0x7f0000000100)={0xd5, 0x0, 0x80})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x4000, &(0x7f0000001000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000400)="f4", 0x1}], 0x41, 0x0, 0x0, 0x0)
ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000500)=@vmx={0x1, 0x0, 0x2080, {0x1000, 0x2000}})
ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000600)={0x0, 0x1000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000700))
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0xf4240)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7ffffffffffff000, &(0x7f0000001000/0x1000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='disk\x00\x00\x00\x00\x00\x00\x00\x00', 0x4)
executing program 1:
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xfc, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}]}]}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x40810}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_TX={0x8}]}, 0x1c}}, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@uexit={0x0, 0x18, 0xaaaa}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2710, 0x0, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000140)={0x8000000, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x1, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})

program crashed: SYZFAIL: posix_spawnp failed
bisect: bisecting 14 programs
bisect: split chunks (needed=false): <14>
bisect: split chunk #0 of len 14 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 2, 4, 2, 10, 6, 4, 18, 9]
detailed listing:
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x24}, 0x0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00224102000083000400000b11200000b3"], 0x0}, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
close(0x3)
ioctl$HIDIOCGUCODE(r2, 0xc018480d, 0x0)
syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', 0x8488, &(0x7f0000000340)=ANY=[@ANYBLOB='nobarrier,nls=ascii,part=0x0000000000000000,nodecompose,gid=', @ANYRESHEX=0x0, @ANYBLOB='\x00'/15, @ANYRESHEX=0x0, @ANYRESDEC=0x0], 0x3, 0x72f, &(0x7f0000000dc0)="$eJzs3U1sHGcZAOB3dtdrb4rcbZu0BSHFakQEDSS2l5IgIWGqCvlQQSQuvZrEaays3WC7yIkQcYDCEU4ohx6KkDn0hHpAKuJQUc5ISFyR75F6r3pg0fzsendtr9dxbKfmeaTZ+Wbm+3nn9cy363GiDeD/1uwbMbIeScxeeH0t3d7caDQ3NxqL7XJEjEZEKaKSryJZikg+jpiJfIkvpjuL7pLdxnnl4Yfvnn/wfiPfqhRLVr80qN2W1oAR1oslJiKiXKxjbF+ZqOzW37V4Ne+vy719dZ104k4Tdq6dODhurY6kKK/vp/kQ9y3wpLsXUR7ZYX894lTxVpp+DohidigdcXiP3b5mOQAAAHgylfeq8HREEmsxfjThAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMmQ5N8ZmBRLqV2eiKT9/f/VYl+qWj3meAf7+h7H37lxRIEAAAAAAAAAwKH4oPjD/dlP49NYi/Fs4wsRrST7m/9L2fbp7PWpeDtWYj6W42KsxVysxmosx1TEyHhXh9W1udXV5antLX8factWq3WvaDkdEfVtLad3CbT0+M8dAAAAAAAAAE6gX8RsjB93EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0C2JKOerbDndLtejVImIsYiopvXWI/7WLn+efXTcAQAAAMDhqxXr8eS/eaGVZL/zP5/93j8Wb8dSrMZCrEYz5uN69iwg/62/9K/1RnNzo7GYLts7/t4n+4oj6zEiynF/l5EnsxpnOi1m4/vxo7gQE3E1lmMhfhpzsRrzMRG19CRiLpKo1/KnF/V2nDvHO9OzdbVTauVne7Yv1hezSGpxIxay2C7GtWrkj02yc0jHfLFrtL9UI/pGvJ9mJ/luYcgcXe/6ef2ueC7TjvTpIfs4HPXszEc6GZlMc19k45nBuR94nfxkz5GmotR5BnW6GOGjzY10s3+kds5/vJ+cn8pXY+nLr3tz/rgNeJQ2ssO+/kxMR6m4+iKe78357a88eLa38df+/ferN0tLt27eWLlwiKd0EBN7VegkpT8Tja5MvDD46isy0UwzsT5UJmZip5/H2BAtj0C1yEY2FQ05W76Wlebipa5L8K24HvNxOSZjKq7EZHw7pqPRucLS5UxPXiuNxd6cZPdaafv8VhsQ/LmvdlX6zR6Vj1aal2e68to909WzY8Wemd/GZNfV9+zgq+/+J6/9MC8NOSOl43+pKKdj/LLzjvMk6MlEMTe3o3tucCb+0EpfV5pLt5Zvzt0ecrzzxTq9bd/pnZv/OHzU/e/uB9GOIL1e0hm3km1lOam1r5f02HOdur35qhZ/ccnbFdfZc1vHznSO1WM8FuIHu96p1eIzXE9PxftEeuyF7mP/2Zo5q8Xnm/axnk858VY0s08hffacqgE4YqdePlWtPaz9s/Ze7Ve1m7XXx14dvTL65WqM/KPy1/KfS38qfSd5Od6Ln8f4cUcKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnwcqdu7fmms355U4hxvr3dBVKux/avVDddazBhSjtWWfjqeE6jHrE4LGSolB9hBM8YYVa9O1pf7/RQXv+ICKyQrld6KlTPXDwyZ7XWCkOOESah8eS51YrT2q2p1XeR/NKu9XOdSqxMha35pJK3x33WavVGu3cBWPZj+CzVqu7Ti26bhnghLu0unj70sqdu99YWJx7c/7N+aXpK5evXG58a+qbl24sNOcn89fjjhI4DCt37pZ32L3TNw8DAAAAAAAAAAAAT4jiX/+vPvJ/Zqhs/ReaQm+d6vLKziOfPcKzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD7PZt+IkfVIYmry4mS6vbnRaKZLRL27WmlrlfwsIvk4Yibypadists4rzz88N3zD95v5FuVYsnqlwa1G856scRERJSL9d5Gd+hme3/Xuvpbf6Twks4Zpgk7104cHLf/BQAA//+VIu5E")
r3 = getpgrp(0x0)
sched_setaffinity(r3, 0x0, 0x0)
r4 = gettid()
timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=<r5=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r6 = userfaultfd(0x1)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00'})
sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r8=>0x0)
fcntl$lock(r6, 0x25, &(0x7f0000000040)={0x0, 0x2, 0x5fd12af8, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r8, 0x1, &(0x7f0000000240)={{0x77359400}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r9 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r9, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./memcg\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./memcg\x00', &(0x7f00000000c0)='cgroup2\x00', 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138aeb4, &(0x7f0000000200)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfee00900})
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_DISABLE_QUIRKS2(r1, 0x4068aea3, &(0x7f0000000100)={0xd5, 0x0, 0x80})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x4000, &(0x7f0000001000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000400)="f4", 0x1}], 0x41, 0x0, 0x0, 0x0)
ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000500)=@vmx={0x1, 0x0, 0x2080, {0x1000, 0x2000}})
ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000600)={0x0, 0x1000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000700))
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0xf4240)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7ffffffffffff000, &(0x7f0000001000/0x1000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='disk\x00\x00\x00\x00\x00\x00\x00\x00', 0x4)
executing program 1:
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xfc, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}]}]}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x40810}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_TX={0x8}]}, 0x1c}}, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@uexit={0x0, 0x18, 0xaaaa}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2710, 0x0, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000140)={0x8000000, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x1, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 10, 9, 16, 19, 6, 4, 18, 9]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000400000)={0x0, &(0x7f0000401000)=[@uexit={0x0, 0x18, 0xb}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0xf4240)
ioctl(r3, 0x4048aecb, &(0x7f0000600000)="0000000000000000008000"/72)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl(r3, 0x4048aecb, &(0x7f0000600100)="070000000000000001000000ffffffff0100"/72)
executing program 3:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}], 0x18})
write(0x1, &(0x7f0000c04028)="01000000000000000040000000000000", 0x10)
ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000180)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x20}]})
ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r3, 0x4068aea3, &(0x7f0000002280)={0xa3, 0x0, &(0x7f0000000100)})
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000002300)={0x1, 0x0, [{0x40000073, 0x0, 0x3001}]})
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000000200)=@vmx={0x5, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffd, 0x0, 0xfdfffffc}, 0x1c)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup(r2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000580)="2e1221b23bb601c477d3df163e75963d86dd606712e9000d118db0049d28b31c32a790343c", 0x25}, {&(0x7f00000005c0)="0046053cb304538a9927911e00005a", 0xf}, {&(0x7f0000000240)="a43b2eaab4000000000080", 0xb}, {&(0x7f0000000540)="57348a", 0x3}], 0x4)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x12, {"f4", 0x1}}], 0x12})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5)
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@code={0xa, 0x1b, {"c7050000000000000000", 0x1}}], 0x1b})
r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r10, 0x3, 0x11, r9, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r9, 0xaea2, 0x100000)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0xf4240)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7ffffffffffff000, &(0x7f0000001000/0x1000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='disk\x00\x00\x00\x00\x00\x00\x00\x00', 0x4)
executing program 1:
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xfc, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}]}]}, @CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x40810}, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_TX={0x8}]}, 0x1c}}, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@uexit={0x0, 0x18, 0xaaaa}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2710, 0x0, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000140)={0x8000000, 0x100000})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x1, 0x8000000, 0x200000, &(0x7f0000e00000/0x200000)=nil})

program crashed: SYZFAIL: posix_spawnp failed
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 10, 9, 16, 19]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000400000)={0x0, &(0x7f0000401000)=[@uexit={0x0, 0x18, 0xb}], 0x18})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0xf4240)
ioctl(r3, 0x4048aecb, &(0x7f0000600000)="0000000000000000008000"/72)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl(r3, 0x4048aecb, &(0x7f0000600100)="070000000000000001000000ffffffff0100"/72)
executing program 3:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}], 0x18})
write(0x1, &(0x7f0000c04028)="01000000000000000040000000000000", 0x10)
ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000180)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x20}]})
ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r3, 0x4068aea3, &(0x7f0000002280)={0xa3, 0x0, &(0x7f0000000100)})
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000002300)={0x1, 0x0, [{0x40000073, 0x0, 0x3001}]})
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000000200)=@vmx={0x5, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffd, 0x0, 0xfdfffffc}, 0x1c)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup(r2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r1, &(0x7f0000000380)=[{&(0x7f0000000580)="2e1221b23bb601c477d3df163e75963d86dd606712e9000d118db0049d28b31c32a790343c", 0x25}, {&(0x7f00000005c0)="0046053cb304538a9927911e00005a", 0xf}, {&(0x7f0000000240)="a43b2eaab4000000000080", 0xb}, {&(0x7f0000000540)="57348a", 0x3}], 0x4)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x12, {"f4", 0x1}}], 0x12})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5)
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@code={0xa, 0x1b, {"c7050000000000000000", 0x1}}], 0x1b})
r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r10, 0x3, 0x11, r9, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r9, 0xaea2, 0x100000)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})

program crashed: SYZFAIL: posix_spawnp failed
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 19]
detailed listing:
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x12, {"f4", 0x1}}], 0x12})
r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_kvm_exit$x86(r5, 0x5)
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$x86(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@code={0xa, 0x1b, {"c7050000000000000000", 0x1}}], 0x1b})
r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r10, 0x3, 0x11, r9, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r9, 0xaea2, 0x100000)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})

program crashed: SYZFAIL: posix_spawnp failed
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_IRQFD
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})

program crashed: SYZFAIL: posix_spawnp failed
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_IRQFD
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000700)={r4, 0x0, 0x0, 0xffffffff})

program crashed: SYZFAIL: posix_spawnp failed
bisect: concatenation succeeded
found reproducer with 19 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)
ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL-openat$kvm
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2-ioctl$VHOST_SET_VRING_CALL
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
r4 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af71, &(0x7f0000000500)={0x0, r4})

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat-eventfd2
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)
eventfd2(0x0, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/vhost-vdpa-0\x00', 0x2, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/vp-vdpa/bind\x00', 0x1, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='vp-vdpa\x00', 0x8)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
program did not crash
simplifying guilty program options
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
program did not crash
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
program did not crash
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program did not crash
validation run: crashed=false
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd)

program crashed: SYZFAIL: posix_spawnp failed
validation run: crashed=true
reproducing took 1h32m19.118287948s
repro crashed as (corrupted=false):
2026/07/26 18:30:05 executed programs: 3
2026/07/26 18:30:10 executed programs: 163
2026/07/26 18:30:15 executed programs: 344
2026/07/26 18:30:20 executed programs: 526
SYZFAIL: posix_spawnp failed
 (errno 5: Input/output error)
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

final repro crashed as (corrupted=false):
2026/07/26 18:30:05 executed programs: 3
2026/07/26 18:30:10 executed programs: 163
2026/07/26 18:30:15 executed programs: 344
2026/07/26 18:30:20 executed programs: 526
SYZFAIL: posix_spawnp failed
 (errno 5: Input/output error)
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF