Extracting prog: 1h28m51.670152994s
Minimizing prog: 11m36.265104988s
Simplifying prog options: 0s
Extracting C: 1m22.058566723s
Simplifying C: 10m5.588840427s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_TUNSETSNDBUF2-process_madvise$auto_MADV_NORMAL-mmap$auto-close_range$auto-socketpair$auto-socket-setsockopt$auto_SO_WIFI_STATUS-openat$auto_usbdev_file_operations_usb-openat$auto_sg_fops_sg-readv$auto-write$auto_sg_fops_sg-ioctl$auto_VHOST_SET_VRING_ADDR2-socket
detailed listing:
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 30, 30, 14, 27, 27, 26, 29, 30, 40, 22, 29, 3, 3, 13, 30, 29, 29, 19, 14, 4, 40, 4, 19, 15, 26, 30, 3, 13, 11]
detailed listing:
executing program 0:
r0 = fsopen$auto(0x0, 0x1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r2, 0x711, 0x70b52c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848)
r3 = socket(0xa, 0x801, 0x84)
r4 = socket(0xa, 0x1, 0x0)
setsockopt$auto(r4, 0x29, 0x37, &(0x7f0000000080)='\x15!\xa8^J/\xddCx4!\x00\xd3\x8f\x1e\x1b\xc3 \xe2\xa8\xd6\xd9\xc0\xa2\x0f\x88\xb1e\x8a\xd8?\xfe\xda\xc4\xef\xff(i\xc6@\x91[\vBj\x0eQ\xce\x16\'C\x8cYA\x92u\xd5\xb8\\\x82,\xe2=y\x9bR\xbcn\xa0c\x16~\x86\"t\xde\x14\xe4\xa5\xfe\xb5', 0x110)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x9c)
fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0)
openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/block/loop6/rqos/wbt/id\x00', 0x101a00, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2000a, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x5, 0x400a)
process_vm_writev$auto(0x0, &(0x7f00000011c0)={&(0x7f00000001c0)="42777dd1330b458d0b5c44ca32e94fc00cfbce962ee7d8f31c0f90c327830f55adfdceafcc0f7b5a21ea23bdf5344d47d49d60218e57bb33118d04fdd37f5fd17f96", 0x8}, 0x7, 0x0, 0x7, 0xb5)
sendmsg$auto_TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000094}, 0x8080)
r5 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, 0x0)
sendmmsg$auto(r5, &(0x7f00000006c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200)="4c0300000000000000a3677337f9eca9075f6bba441b", 0x49}, 0x5, 0x0, 0x5, 0x1}, 0x5}, 0x2, 0x100)
r6 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0)
ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r6, 0x80085502, &(0x7f0000000140)=ANY=[@ANYBLOB="1000006e061e0ec3b417bee1e649c8b817d7a922cb9526d474f20699f1ab6bd6953f82874c6cd0230cb5bf"])
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/ptp/ptp0/n_vclocks\x00', 0x8502, 0x0)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
openat$auto_ext4_dir_operations_ext4(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/bluetooth/hci4/power\x00', 0x20100, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0xfffffffd, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x4000000000007, 0xa505}, 0x800}, 0x4, 0x4008)
executing program 0:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 0:
openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x30db80, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000240)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7fffffff, 0x10)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x1, 0xeb1, 0xfffffffffffffffa, 0x2)
openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000002840)='/sys/kernel/tracing/trace_clock\x00', 0x8000, 0x0)
fchmodat2$auto(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x61ed, 0x4)
r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x60800, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000840)={{@raw=0x8, 0x7, 0xba28, 0x0, "708c58271a7985a7704331f78af8d149fc53d81fd4a7553c2ff48b48a8a57689adcc1ca6d2cbfa93b50590c9", @raw=0x6}, 0x0, @bytes=@data_ptr=0x0, "fa491e08108961dd5708680f1134935851612a52d629535f54f3832490fc4e7f79daef312b3df3307044713a4801d409aefe3f932f78fc311771094e769c0095f94ee6d74f2517f34a0bbbf502bf3392ac4d93bde5f733ba936c0890312cf035bc44117db9b683eedc5e02a703fc82750d8d6ebac0c3019ef8e6c1eecea33a59"})
setsockopt$auto(0xffffffffffffffff, 0x11, 0x66, 0x0, 0x8)
setrlimit$auto(0x5, &(0x7f0000000000)={0x3, 0x4})
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r2)
unshare$auto(0x40000080)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop4\x00', 0x14be02, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r3, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
mlock$auto(0x7c88, 0x7fff)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0x3000000, 0x0, 0x40000000001, 0x0, 0x5}}, 0x100003, 0x9)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/maps\x00', 0x0, 0x0)
pread64$auto(r4, 0x0, 0xeda5, 0xc86)
close_range$auto(0x2, 0x8, 0x3)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto_KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)={0x7, 0x0, [{0x40000001, 0x2, 0x1}]})
getcpu$auto(&(0x7f00000000c0)=0xa51e, &(0x7f0000000140)=0x4800000, &(0x7f0000000180)={[0x5035, 0x2, 0x1, 0x4, 0x9, 0x8001, 0x9, 0x6, 0x9, 0x6, 0x0, 0x1, 0x2, 0x7, 0x4, 0xffffffff]})
socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
executing program 0:
ioctl$auto_NS_GET_TGID_IN_PIDNS(0xffffffffffffffff, 0x8004b709, 0x0)
bpf$auto_BPF_LINK_GET_NEXT_ID(0x1f, &(0x7f00000002c0)=@enable_stats={0x7f}, 0xa6)
sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, 0x0, 0x20008800)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1a/sun\x00', 0x0, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x3, 0x6)
lsm_list_modules$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x401c5820, 0x0)
mkdir$auto(0x0, 0x353)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x5, 0x73)
socket(0xa, 0x1, 0x84)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x13)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/rcutree/parameters/rcu_resched_ns\x00', 0x20000, 0x0)
read$auto(r1, 0x0, 0x20)
socket(0x2, 0x801, 0x106)
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x4000000008000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmsg$auto_MACSEC_CMD_ADD_RXSA(0xffffffffffffffff, 0x0, 0x4008884)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x400000003)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x14, r3, 0x1, 0x70bd31, 0x25dfdbfc}, 0x14}}, 0x24048004)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
r4 = socket(0x2, 0xa, 0x1)
openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ubifs/chk_orphans\x00', 0x426a2, 0x0)
bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_4={0x1f, r4, 0x10000}, 0x10)
executing program 0:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 32:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x3, 0x9)
io_uring_setup$auto(0x1, 0x0) (async)
io_uring_setup$auto(0x1, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
timer_create$auto(0x9, 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa}) (async)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa})
socket(0x2c, 0x3, 0x0) (async)
r2 = socket(0x2c, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'dummy0\x00', <r4=>0x0})
bind$auto(r2, &(0x7f0000000100)=@xdp={0x2c, 0xc, r4, 0x1e}, 0x6b)
sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x200400b0)
r5 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), r0)
sendmsg$auto_NFC_CMD_STOP_POLL(r3, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x40, r5, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x9}, @NFC_ATTR_DEVICE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x1d, 0x14, '/proc/sys/dev/cdrom/info\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x24008001)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x6, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0)
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 1:
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card1\x00', 0x2000, 0x0)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48500, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/003/001\x00', 0x42082, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
memfd_create$auto(&(0x7f0000000040)='A^^\x02\x00\xef\x97\x8aY\x00\x00\xd2\x8c\xb05\x03\\\xb2\xbf247{\xde\t8\f\x00\x00\v\x00\x82\xcc\"K\xe1IIT\x00'/54, 0x5)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0)
r1 = mq_open$auto(0x0, 0xfe, 0x9, 0x0)
socket(0x18, 0x80000, 0x2) (async)
socket(0x18, 0x80000, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2062, 0x0)
write$auto(r2, 0x0, 0x81)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_KSMBD_EVENT_SHUTTING_DOWN(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) (async)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0)
openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x8800, 0x0)
socket(0xa, 0x2, 0x0)
r3 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000001280)='/dev/sequencer2\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4) (async)
r5 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080)
socket(0x28, 0x2, 0x1)
close_range$auto(0x2, 0x8, 0x0) (async)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8, @ANYRES8=r3], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
mmap$auto(0x0, 0xb, 0x6, 0xeb1, 0x3ff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
pipe$auto(0x0)
r2 = socket(0x11, 0x80003, 0x200300)
setsockopt$auto(r2, 0x107, 0x18, 0x0, 0x9)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000940)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="3b3d2abd7000fddbdf250304000008000300", @ANYRES32=r6], 0x28}}, 0x80)
fstat$auto(r3, &(0x7f0000000340)={0x80000001, 0x0, 0xed52, 0x4, <r7=>0xee00, 0xee01, 0x0, 0x5, 0x7fff, 0x0, 0x4, 0x3, 0x5, 0x7, 0x9, 0xfffffffffffffffc, 0x5})
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)={0x12b, r1, 0x1, 0x70bd2f, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_WANTED={0x78, 0x3, 0x0, 0x1, [@nested={0x74, 0x3, 0x0, 0x1, [@nested={0x0, 0x8c, 0x0, 0x1, [@nested={0x0, 0x72, 0x0, 0x1, [@generic="2e14476dec9046786521c57319ac9616fd7cf51cf743ad89449876c7c0607b28c8172bdd62ea012be24b1790e40e414cec12eaea6c6fda1a55835662583a1c57bc4a0f6f29ccf0577db9611988ed14f5920883328b6fd195f34d604d028b"]}, @typed={0x0, 0xde, 0x0, 0x0, @uid=r7}, @generic, @generic="a7f1e130c8bcc7c366885a458370fc86a12dec0c1c00999abe454f1156485fa3207e5591b82f3747eeb017c42ee069ef7d2456a0b96450142ed0331743498b020c0631527e101cd9f2cf97d71444407d364774493bce9ce4f7e5ed65a9c28e9ec92f81ad46e09179edcc6441391918af7ec4290a904da3af9967f1168a7233ac798fc5466894170ce425ff55207ae291ef406ebc69ec6e8e478683d5455bed39f762bdfdc1008b8199c13ef6e664d07f570595462869e5bda41dd195bbfcc20276"]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x4}, @ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x0, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfa03}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xed0}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x10c}}, 0xc881)
executing program 4:
syz_genetlink_get_family_id$auto_net_shaper(0x0, 0xffffffffffffffff)
mmap$auto(0x0, 0x20006, 0xdf, 0xeb1, 0x401, 0x8000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x305c00, 0x0)
setgroups$auto(0xa1, &(0x7f0000000000)=0xc)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto_seq_oss_f_ops_seq_oss(0xffffffffffffffff, &(0x7f0000000c80)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba4291bae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d8", 0xb9)
r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x42, 0x0)
write$auto(r1, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9)
close_range$auto(0x2, 0xa, 0x0)
madvise$auto(0x0, 0x200007, 0x8)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x810)
openat$auto_proc_loginuid_operations_base(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/loginuid\x00', 0x109000, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/irq/11/smp_affinity_list\x00', 0x129542, 0x0)
read$auto(0x3, 0x0, 0xf34)
madvise$auto(0x0, 0x2003f0, 0x15)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/time\x00')
setns(r3, 0x0)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x141002, 0x0)
mmap$auto(0x19, 0x0, 0x7, 0x10, r2, 0x7867)
fsconfig$auto(r2, 0x200001, &(0x7f00000000c0)='\x98\a\x84\x88f8\xe6Gd0\x84@t\x8d%T\x99\xe0\a^\x12\x12\xe6\xce\x81\xd1\xcd\xcfb\xd1*\xdbY\xd6\x14\xb2\xed\x02\xae\'p\xe9\x106\x98\xaa9\xa4P,\xee\xbfQ\xa2\xa0S\xfa', &(0x7f0000000280), 0x0)
lremovexattr$auto(&(0x7f0000000440)='}[,&*}\x00', &(0x7f0000000480)='/de~/bus/usb/001/001\x00')
close_range$auto(0xffffffffffffffff, r3, 0x1b60)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(r4, r0, 0x8)
write$auto(0xca, &(0x7f0000000140)='\x04\x0e\x06\xd5\x89|d\v\x00\x00@\x00\x81\x00\x00\x00\xf6\xf5\x00\xdf\xff\x00', 0x10)
mmap$auto(0x0, 0x402000d, 0xa, 0xeb1, 0x401, 0x8000)
sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="060000", @ANYRES16], 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8a0)
executing program 1:
socket(0x26, 0x80003, 0x854)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_DISCONNECT(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={0x0}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
executing program 1:
mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x40342, 0x149)
openat$auto_ftrace_event_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/events/vmalloc/alloc_vmap_area/filter\x00', 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001480), r0)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f00000003c0)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdc00, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c000}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_NBD_CMD_DISCONNECT(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
r3 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000040), 0x98842, 0x0)
ioctl$auto_PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000080)=0x7)
openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy17/aqm\x00', 0x6180, 0x0)
read$auto(0x3, 0x0, 0x8080)
executing program 2:
openat$auto_proc_tid_children_operations_internal(0xffffffffffffff9c, &(0x7f0000000080), 0x41180, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0)
unshare$auto(0x40000080)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
setresuid$auto(0xffffffffffffffff, 0x0, 0x0)
write$auto(0xffffffffffffffff, 0x0, 0x100000a3d9)
pread64$auto(r0, &(0x7f0000000100)='\x00', 0xa7, 0x5)
mmap$auto(0x0, 0x2020009, 0x5, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x2003f2, 0x15)
syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x24048084)
madvise$auto(0x0, 0x200007, 0x19)
syslog$auto(0x3, &(0x7f0000000080)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0x5)
mmap$auto(0x0, 0x400008, 0xdf, 0x4000000000009b72, 0x2, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x801, 0x84)
r1 = getpid()
process_vm_readv$auto(r1, &(0x7f0000000000)={0x0, 0xfff}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000280)="8618c61e", 0x40000000001243}, 0xa, 0x0)
setsockopt$auto(0x3, 0x0, 0x4, 0x0, 0x28)
sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3)
sched_getattr$auto(0x0, &(0x7f0000000000)={0xcf86, 0x6, 0x6, 0x200, 0x7, 0xb, 0x6, 0xfffffffffffffff8, 0x8, 0x90}, 0x68, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0x8000000000000000, 0x15)
brk$auto(0x40008000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000280)='/proc/asound/modules\x00', 0x88400, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r2, &(0x7f0000000040)=""/209, 0xd1)
socket(0x200000000000011, 0x2, 0x1)
executing program 3:
mmap$auto(0x100000000, 0x2000d, 0x1, 0xeb1, 0xffffffffffffffff, 0x100000000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty17\x00', 0x1, 0x0)
semget$auto(0x0, 0x13c, 0x1ff)
recvmmsg$auto(0xffffffffffffffff, &(0x7f00000001c0)={{0x0, 0x5, 0x0, 0x9, 0x0, 0x800000000005, 0x7ffffffd}, 0x8}, 0x3, 0x1, 0x0)
semtimedop$auto(0x0, &(0x7f0000000140)={0x7, 0x81, 0x70}, 0x1f4, 0x0)
r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r1 = openat2$auto(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)={0x982, 0x6, 0x4}, 0x7f)
r2 = syz_genetlink_get_family_id$auto_802_15_4_mac(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$auto_IEEE802154_ADD_IFACE(r1, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00012a000b000900000005002800d4000000060010006a05001d004000"/46], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x525a05df5b8ef67a)
ioctl$auto_SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0)
socket(0x1e, 0x80000, 0x9)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptye9\x00', 0x101e81, 0x0)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x2c402, 0x0)
r4 = ioctl$auto_TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, &(0x7f0000000180)=0x10)
write$auto_dev_fops_plock(r4, &(0x7f0000000200)="ea579eafbef6a78ace20c66c3ed28a307811ba5a77e0d6f20eee070874ce267321ef2da8ccef77a2a57912658cfac38b23199ba898ef2c29ea039494e108e23fc3d3de801c6cdb8c585be1ec026d327ad05a0c7812805bb6d050f902f2e77e549ec276c282a2bb8c2847f2e7105018d493a4a1dc", 0x74)
r5 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000980)='/dev/ttye9\x00', 0x102, 0x0)
rseq$auto(&(0x7f0000000300)={0xe, 0x401, 0x0, 0x6, 0xffffffff, 0x2}, 0x8000, 0x0, 0x6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x16, 0x21, 0x6, 0xfffffffffffffffe, 0x5)
sendfile$auto(r5, r3, 0x0, 0x1fff5)
close_range$auto(0x2, 0x8, 0x0)
r6 = openat$auto_nsim_dev_trap_fa_cookie_fops_dev(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/netdevsim/netdevsim6/trap_flow_action_cookie\x00', 0x4, 0x0)
io_uring_setup$auto(0x1, &(0x7f00000004c0)={0x7, 0x400, 0x3, 0x8, 0x9, 0x7, r6, [0xe, 0x80, 0x101], {0x1ff, 0x800, 0x5, 0x3, 0x4, 0x2, 0x0, 0x0, 0x9}, {0x1ead, 0x10, 0x5, 0x5, 0x5, 0x7, 0xa2f, 0x42e646f9, 0x1}})
semctl$auto_GETNCNT(0x0, 0x4, 0xe, 0x4)
io_uring_setup$auto(0x4bf15e08, 0x0)
bpf$auto(0x12, &(0x7f0000000040)=@enable_stats={0x1}, 0x26)
recvfrom$auto(0x4, 0x0, 0x101d0, 0x3ffffd, 0x0, 0x0)
unshare$auto(0x40000080)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x40000008000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda1\x00', 0x4040, 0x0)
mmap$auto(0x0, 0x400008, 0x8, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/ptp/ptp0/max_adjustment\x00', 0x168040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x2020009, 0x203, 0xeb1, 0xfffffffffffffffa, 0x8000)
unshare$auto(0x40000080)
dup2$auto(r1, 0xffffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xc18260, 0x0)
ioctl$auto(0x3, 0x800005411, 0x38)
sendmsg$auto_IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x4044000)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
socket(0x26, 0x800, 0x8)
read$auto(0x3, 0x0, 0x7fffffff)
mmap$auto(0x0, 0x2020009, 0x6, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0xffffffffffffffff, 0x8, 0x0)
sysfs$auto(0x2, 0x4000007, 0xfffffffffffffffc)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
write$auto(0xca, 0x0, 0x83)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x27ffe)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, 0x0, 0x208000, 0x0)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x18b800, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x1000, 0x2)
mbind$auto(0x0, 0x8000000000000001, 0x6, &(0x7f00000000c0)=0xffffffff, 0x7, 0x3)
ioctl$auto_SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0)
capget$auto(0x0, 0xfffffffffffffffe)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x800, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000)
r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000440)='/proc/fs/cifs/DebugData\x00', 0x2000, 0x0)
pread64$auto(r1, &(0x7f0000000040)='/proc/scsi/sg/devices\x00', 0x10001, 0x3)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
prctl$auto(0x3e, 0x801, 0x0, 0x1, 0x2)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x1102, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x5, 0x8000)
executing program 3:
unshare$auto(0x40000080)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
r1 = prctl$auto_PR_SET_MM_ARG_START(0x0, 0x8, 0x0, 0xacb, 0xfffffffffffffe01)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_SW_SYNC_GET_DEADLINE(r1, 0xc0105702, &(0x7f0000000000)={0xa6fe, 0x0, <r2=>r0})
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000180), r1)
sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x100, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004983}, 0x20000040)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptya7\x00', 0x101e81, 0x0)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
io_uring_register$auto(r4, 0x9, &(0x7f00000001c0)="c36736685c38b88292237ee11f7a94d988b9b0d4ef73b9765aa881edbd0301d50b67502ee2a9243e5e2db48d15c22ced4fb53def384399f9de63bc7cc7800169e12f7f6a54982e5c3987d8f044edb7abc42eda929e496f783fb572edac35025ba22aa46ede59f3eb236a481cbc6ed26372315f7ff7b1d173ea8ac334380ada4447d2918637e5359302db30603bfb9456e50f2c67bd982c16d208d9c0de1c354135b398ea88bee6e55110e84870bbe598856e765961a13a3d7bcecfbd381ab62752edbb09ac19af7b5f27f2fed7dd1966da821d2cfd1795c4db38c890a9aa1fa1610bdade665c194218d58eae4af9357015e8", 0x3)
sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07)
read$auto(0x3, 0x0, 0x7fffffff)
executing program 3:
r0 = openat$auto_binder_features_fops_(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binderfs/features/freeze_notification\x00', 0x141000, 0x0)
pread64$auto(r0, 0x0, 0x2, 0x7a)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
executing program 3:
openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0) (async)
r0 = openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0)
write$auto(r0, &(0x7f0000000080)=',}#-#-}}\x00', 0xe6)
openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4) (async)
r1 = openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4)
ioctl$auto_RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000100)={0xfffffffd, 0x4b, 0x0, 0x8, 0xfffffff9, 0x3, 0x9, 0x1000, 0xfffffe00})
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200) (async)
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200)
clock_nanosleep$auto(0x3, 0x0, &(0x7f0000000180), &(0x7f00000001c0)={0x7, 0x75})
openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
pselect6$auto(0x7f, &(0x7f0000000240)={[0x9bb, 0x9, 0x2da3, 0x5, 0x80000001, 0x8, 0x4, 0x7f, 0x2, 0x61, 0x948, 0x6, 0x0, 0x8, 0x80, 0xffffffff]}, &(0x7f00000002c0)={[0xffffffffffffffff, 0xfffffffffffff5e9, 0x1000, 0xffff, 0xfffffffffffffffe, 0x200, 0x8000000000000000, 0x0, 0x6, 0x4, 0x2, 0x0, 0x6, 0x0, 0x17d9ec6d, 0x25b6]}, &(0x7f0000000340)={[0x4, 0xaa, 0x8, 0x4, 0x6, 0x80000000, 0x1, 0x0, 0x8, 0xfc, 0x2, 0x2, 0x1, 0x101, 0x0, 0x7]}, &(0x7f00000003c0)={0x9, 0xffffffffffffff42}, &(0x7f0000000400)="70bbc9eb0bf0c11539c987617cf2d4be5550703972db7a11cd25afacd1f687461bd4bf3452e7d76662a191301d7b003e5cbc13809abd6b56432d5e3bb66950b5d83767caf6d0003987f2784033244b4ab49ed17f17c53adb357ac4186dbe4fc53a0fd13404a9dd364c16373f4f89e051798f53780aba296d3c40fbf4499c4ef95a781498")
syz_genetlink_get_family_id$auto_nfsd(&(0x7f00000004c0), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
nanosleep$auto(&(0x7f0000000500)={0x8, 0x3}, &(0x7f0000000540)={0x10001, 0x5})
mq_timedsend$auto(r2, &(0x7f0000000580)='nfsd\x00', 0x4, 0x9, &(0x7f00000005c0)={0x9d, 0x10000})
io_pgetevents$auto(0xb, 0x7, 0x8, &(0x7f0000000600)={0x3, 0xfffffffffffffff9, 0x7, 0x9}, &(0x7f0000000640)={0x1, 0x41}, &(0x7f00000006c0)={&(0x7f0000000680)={0x6}})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_XFS_IOC_ALLOCSP64(r1, 0x40305824, &(0x7f0000000740)={0x1c3, 0x1, 0x1, 0x4, 0xd, <r4=>0x0})
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async)
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000880), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'nr0\x00', <r6=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'veth0_to_batadv\x00', <r7=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000940)={'ip6tnl0\x00', <r8=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00', <r9=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00', <r10=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000a40)={'team0\x00', <r12=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00', <r13=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ac0)={'pim6reg0\x00', <r14=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000b00)={'ipvlan1\x00', <r15=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00', <r16=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00', <r17=>0x0})
sendmsg$auto_ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000e80)={&(0x7f0000000840), 0xc, &(0x7f0000000e40)={&(0x7f0000000bc0)={0x244, r5, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_FEATURES_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @ETHTOOL_A_FEATURES_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfff}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xf9d}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3f5cc39}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}, @ETHTOOL_A_FEATURES_HEADER={0xa0, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7ff}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x841}, 0x4000)
executing program 4:
r0 = openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000006900)='/sys/kernel/config/target/dbroot\x00', 0x189002, 0x0)
write$auto(r0, &(0x7f0000000100)='/dev/audio1\x00', 0x100000a3d7) (async)
r1 = mq_open$auto(&(0x7f0000000000)='\'\x00', 0x1, 0x8, &(0x7f0000000040)={0x5, 0xff, 0x80, 0x1})
io_submit$auto(0x8, 0x5, &(0x7f00000000c0)=&(0x7f0000000080)={0x6100000, 0x7, 0xc, 0x0, 0x9, r0, 0xffffffffffffff00, 0xfffffffffffffb13, 0x4, 0x0, 0x4, r1})
executing program 3:
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x3)
mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read$auto_rng_chrdev_ops_core(0xffffffffffffffff, &(0x7f0000000040)=""/4096, 0xfffffe82)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0xc8600, 0x0)
getdents$auto(0xffffffffffffffff, 0x0, 0x400018)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_CONNECT(r0, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x8880)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
executing program 4:
r0 = socket(0xa, 0x80003, 0x3a)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
r1 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_OVS_FLOW_CMD_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdc02, {}, [@OVS_FLOW_ATTR_PROBE={0x4}, @OVS_FLOW_ATTR_KEY={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xf, 0x0, 0x1, [@generic="99cb9d0ac5e7ca3d"]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040071}, 0x800)
r3 = setfsuid$auto(0xee00)
r4 = setfsuid$auto(0xee01)
setresuid$auto(r3, r4, r3)
r5 = setfsuid$auto(0xee00)
r6 = setfsuid$auto(0xee01)
setresuid$auto(r5, r6, r5)
r7 = getpid()
process_vm_readv$auto(r7, &(0x7f0000000100)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xf}, 0x6, 0x0)
sendmsg$auto_OVS_FLOW_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001380)={&(0x7f0000000040)={0x1320, r1, 0x4, 0x70bd2c, 0x10000, {}, [@OVS_FLOW_ATTR_MASK={0x12fe, 0x7, 0x0, 0x1, [@typed={0x14, 0x3, 0x0, 0x0, @ipv6=@loopback}, @generic="c30fd0c4f7597fbfb0395890c0bc9741a0af52d26458c9fa9584426c5c5a5a0bf0a4aeb8185d1c4ec803949f5da3d3f5ec37c1144169df1312bf11f928e3f955e65e7c1df1dbe18dd602320e4bd1b2636ddefef6a4ef0e01f7b4ec9ba409b419fcda6a76d02d56d5211100409932ec6c23d7fe823b3fd9a73e56c2bdbe6b0c9de91794349ff4f592b6a66916c6e8463fcde18f195e1b677234d8dca114ad56f53978648df5505d30260365d3edcca96749e87cc7fb7702030b2d0a9e906b07a22da839f1", @generic="d68df5687673c9f7015038865f1e65da7b087cd198617491ee3b595b65cca24c40f7e28afc45b5ebc9d4bfa432b7f2f562865ee5e973886bfe3bdf20ec4ceefcd4c0c2ec7d62e64e545fe6e810712ebf963e4038", @typed={0x8, 0x6d, 0x0, 0x0, @fd=r0}, @generic="5741e1a026549d8bc5d2fd54cc5e4a4eeaec664c2c15fd6b6acd4bc09c6ba77439885bb2b7f24fb594c407fbc157116664fd", @nested={0x1004, 0xe1, 0x0, 0x1, [@generic="fdc2ac8797fd5123fb8f054a89f2a6053181f6d17b5d173169fa3ddad5f3d657523615d068a17f890ff94fe2875c4e3ddb3a62740ed7631f81a5ca800c02fbd9e77ac612d5274297e0f54bc72818543ea539da64e161c8de7e04254c77d7456c5ed9d3d7fdaff775b61300fbe7abb09a5056f08a782617c3dd2c1dae24155379e4b5a92043e52b7e40afb890ac5fbb6b8f1036e31b916b99f255d1b28d895208e1797e216d7567873e870e6872c84b630378318614e3d6727f39988a3d6150b7fa961f78dce67e8e4cef3f666526e4770ef47b6caed08ad1379af68fc2b7df94b5d9bcceb862875da3010893c343a322350a4c1dfe4b6a837be9a835547540535117cdfea59da934381947df85a55b7541591c069288a200db14ed229851f53aa58f24c9c76794d945aa641cede8b3e8517a190f264e00fca600d431705e5f814b270c14d87cb561162594d98103b6e8758c837b2cd102ad0db123a29c492a547f3f6cc7d00539c760b944fef4b62e072a1d45e075e6c78ca95507f58e9e521ab1163e36ca4507a6dd3b47842058ee2f1af962ff157c5e900c35ff15c1d362203f7ddcdf4b657ae761edcdd3b699b65da671e586c39b1da178c871623effbdb3d976412987651b5dd19d9e730646de22505c0ab0661740daf419928ca75c096e7353aa663683902f03ef8cecf24915c47d296128ccf441a74af0ef05678306909f97f09b725e315293ec1867cb92b57843c74dbfa8b1d070fe46e723b3d39a055873b15ee832aef79d67d9bf20ed1d5484f37910301393aad6b1143168ae841f8fc5b4a16ad905f24b5c9599386c1fb692b28b090dbae26a512cb0a4b0b4d7b4aa21131b797ef5fd3d13fbac94434e5bd57510e725e737a2c29d941af2cb0e813d40eeae81f570d685f9388f52dcdb2d54138a4d0e2d65884ba7bb53861c32d6a9e10c382658143e8557fd282d1511075a19e1be411443f8ec863a44abfc0615377949e335bb11d3b478c4590eee9a0e0aca01ba4f9f28f989ef4cc38959bfc3d7f97c4e969296818aada93eeb62c8997faa37c5f8a11d8284d5a21a754451f63efb4acf9d347b802f585862cdb2e60909d11d057e49d0b18c2c7756c91c4ab00e623f2aa627401d5f3eac4c4a984ba8fad3e05f2e7304e69194f69c77ff82d32d41c23272b77137abde44d8750cd0b929dce3b2edd55c81dcf491e90e79c071cd60b030a7b6ee1a83990c36490b2a190ec728a5a31b7ed1112a3694fd8a7df3eafa3fd74fbac17d4c26ba8102a6b45ffc574f15fd82f116d7592ba8edb15d2754602863c9c48f7baee0813d563d04a8622d5d390a290521f0a8f99a71586a9046c6e1b2c37adba3b230852ffada0330337c5abecafc47bb29bb6e52f760084c244800cbff56450534d1736d1b7789dabd3af891caf422a2b78ac26b114e8307165c8a832b72897e6f51a959b42ca2f76824810e6bbbd5f349a0bb96628b66c0804bfaa56a9aa6a24e2a9f7d9ca83e9a0c1913a641e6023536f1cb54a95307bffca43a16e2bea208d51e80e8e58cc4fffc8f6a8f26b45fbc279be3ab5b7b9c6f511a7855101f28f06df45b5d7cc4f103391b2059e27827ed616bbcc009e310838cbf2511d852121b38ebea56821ade02e7640a6febe264972e6158223087c54424b0f8b9ee02743c736cf364140c67f0d9df6a351dab2ee0a85f8431f12ef1afca7549d6b7ff264235ec548eddc0b3400557ad069afa1c9e40464b78fa095b4170212adbb33ad2cdb4614ac02fd38e5d60af960ff964df91acf024f9894e4d33bcc9721fe9df33a8fab4b2f0812355dd21f81acb976e6a7505aa965555bb42d971b207b7ca7c8e896c0ef9ca85fd9a708a82054a44929330929aee29d75c6b16948867a938d7688ce2e030b6b771ed8769336a32b8ff4127dd7739f62d368303fb475f07c3a1358e1480feb15e4284a6416f1ff69ee1d0b41ce44a257ac67500667945c6812295862b0db70658548c0a576c1f5384dc39a4b02e87615604ee0c44aa967d265d1a0f767239cd2e0041ef200863e68e4b835130055601ddd47e35518a1011ec0cc6b279b495cd3d1c470076f31bedf235d1386d6b8052185ab49e3a442ffdc05b7769c4fbc84d1fae685898c036275da551aa26e00a38728dfae2be88125fd388e08e712d2d7b378ef7b06119027c48ef012450f44f2448ecb39ca403abde4673111da68bd9912f58ec7555cb70d2b41137b845db61f12b8d4abfb98b4d04a18a97c70105080aa0603629508d1a329e5b7a1f16a44c42053a7904e3f4b695a5417db17887d0ee23cf2eec277d55cac398957e2ed017613dc50305f13b148a9045841edfbc62e7cdb9618119791f87ad8357cb78f762615a601488af9183021227e50ec330176dee1a04ea9bae39bd31851942ab591e9548cb709209985d7305b73bf1458c62d3c6cfd8b75071e3f28913f9271d36749fb14e9fd4bf9b05f3400551092457c2036df75d9c0345b41bdf25f2a5ca1d1df8d5e5f28d089179252ad2e1c41619441e45d97dd4c228be300a026988edf65f1eaa283dc126aaf0ba7c6f323610a5822ce5fc2cb9f4520a45d863115264f103d49a8b995d9780a7240c87deec19909c91c4b9ebab6e4f9a4669801c44b825ff9158ee94f3f2c3ac0311d20374d4c995cd655a179bfcfebf4e0410b7835b0fdd25a965a8a09e2f341f475222018d289a9c5fd7368d87f686591d247516b9cde5394339cff50a8122585f150f3aaca8ae19d247e87dbc1ac43b02534ec386fd2744a3711eff31fbb6fd5e66142dc2aa0b7dd8cd71b101298ffc55d56b58d690b2dd993bd03e30963764151f992535d53ccdf43d58f640dfef8ad079aa0138abb818085b03a14699c2da78fa34691804ea4cf916d413956b770870ae2312ca6d1b22f3c30fcf5ed33aaa3cd0b4e33c83c39c3bf229b3b54198e3f04da79fa291f89b879a9b67fe244fcaa150ccd64e2c3f238202e3311dcea805c95d3105cc23c80e1ebf9ca93381af6ecf490f8e72e5a136204f9ef50df540f5f312f6546824eedeba19f7bc9ea8dc06c2152d5d0e34a00c7e95dbfe6c0f01e9317e0a68ddef1ac52aa996ef19d5fa27e3b5ec761cc2d7869a7962208224b3c1b3d93526def8eab3534c4bcc7172af697d8004c74a56eb4a13d25e457c87c67995f4e542fdda0b4942dbd362ed16b42041daf44a1438777f96fabdeab74f1de4e86ceb121c9736962e08c60888c4e101b1b5876e325018a6330c459f4f7f57f460913ce0c23699331769a8deacf2df7cbfaca0699f2d40e2f1cb7a604042c5c4be36f8d119b12274eadac6e84fba35d8e94157cbf764946593e4369eadb23f2fef94f697f36b251409758fecc397f4d3d8ab22481f11420de89c935fd1f1b2b97038d2fd84d2044b5f5d11c4a0feb0bd64254806faeb50d3dae6d3ec0ea8edb56ad368914f12083a9818f2737f14330e70106b23f87980df7f1554053fb31c64a800faa49c1b532f742e6d55e32f28c493b74e0af074c6500e6be748ca31c1b37a340360d6277c95b0bb73fc75b1a60dcbb8f6736b98766a2078695a58736fd144b6f1ae17fa72bab965f0c76bdaa87dfaf8a697bacab009de168582224dffe455ff790e6b5a94bc18510c779b057cb55a74bfff8aceb47100881baa083cef35522b0476f9510ad91ec109abf678a7dae3585b2da6557e17b243d107c83e44065293438f77b07c9dc096857c386f8db72924fd0e9bddb81f2bdd8925583aa06582fcbdecb53b3335d1f76bf2320c9cee8a241b0f80486f3f3d8811c60638e1a00a0cc5ea97f286d76d754ed1105d738f0537aab6be8f358b3c7c4a1042281afd6ca2163747c1879e9e1bbe8887ee22ebadb78e6c893d52747f13237a4b24241bd6890bb62ede528069052786f0a73883c9a79211957634fb2b8bbadf0c769bd88cd520d362865da014b768822f539a5386312c0d70ee800c341c8672eb1e9b5b562f1e8590a47d045529e2f7f5d2b77c6459c6c36457a4a88f779789fe617f12aa40b7bcd99617f64dd4eb08c0bc5c300f467519ae71d1a0d4dbacc1fb145c8f47cf6a78c4dcecac1f784c59cbaa40f5bcda0176df9057afaa0536d4fc8f63ee486505c0453510cf88d4bc361737b65f1122665d19f51e25004c57ab35f8d05a2582f634c0a3bc5a1a047160803b11cae161d8bc4e2c5719bca313fb844f8c6323fbce9d22e3a43e01cc690da736fbf2a88eea35498ace6f3a327b907a39a8922480b4123f8e89b1d191d8c478fbe189401f9005a17eb12d673cf2352ede5ca2573239e2249db0cd131efe39f43f840be8f7f9194ce265dcb568bda7364bb8425380d5c928c41ef53aa1716aa113e22f12a5390ffa56f58c6f3d71ad29b68631b067ba9debe1ec546403730c3ba56f4acba0b323544f01386fb62e447b308ea1e600f48d13202b8a06c4a3179ca3915788ee66244375e6cac2a5fa6ea6ca8e95f535e86cd0744d6f01b67cd2da7945be620865908ef9a71158a47ec572076d098b169860ae24cf3ce70af74d23ddd3b4b280b09c8a3fba6f9eeb0b3a9ec542645e25f14f6ccbca18b041204b6b1207b58820096a7bda02cf1c8bf1c147479b7eef667ba0717cbfa066a525ad9c162832b7408f355aaecdc739e358defd599bec95060a28f828561fa2b50e0293a26d61d901e9f7715a29ed495e2e40610e3cf0aefe2f41dad38004f874f04496583765f9e1ed5f077a389e095e1cbc8ec62fb9b91e5b67ed4cd65e9297c36154613a50d843794f1420dd17e01ee28082d67dfb20eb7315a9b2f015efd7395e98168315d2130d657c942d60a68c378f3537ffe886a674f7c9c1793bf4a59df0405d47f2efbcf94dc4741cdde698407b34598cefff1ac43e27a6f0f4e544ac3f81ce377c4f003047d17fc5a41893ccf262806d1b831df9747977ebdae7ea45d6e4debafe3e5f9bd1e0c37b741ee7161ddacf00501b8ee14f9f8baa8ba4d9c109f9fea7ada055c395958fa2c0ecbe515ba66d714db5ad7550d91708e8cbab43d91a0f247d4e6dc25954504213c3b6b193521f05915da79e0bdb16992bbab36cd5775d01e57f983478cba942bb3773046a7e3eeb5ce6aef42ced902c0a30e12394b8704f70d94924fde69e793e9b84cdf240b103918211259dedc5edf135df57d7bf07e266f31a04bff80f8fa57dac7f6faa5058d796a7dd36299a8a680218f6d9a31867128dc0b66e4dbe4de8796552c6a6c78ef85aa959e42eb0c980e05aa47b20a3a4578fb23d198e28de5fab14882870106f1e7c448e4368fd0acb68bcaa6895f3d7f50aea413ce96042ae80e258eca17374af3326cc6b462d337c2b9ab9f197208d6358801e7048469d0230229e3310660732c439b571b965cc89cbe30b74387a2124ce654a008f9486a6d4d6e5e29e5c7382a240bd2f241e68f255e3021ca659d58db2671219e6dee6b6b6ab74b31d13dbf04bfa38a6f58b49a9605c21a081a771a29c76e34fdbbb5866ed88c020ee535ce576e3711c253dbd1cf3aa876094ad13dd926c0997f716b2374f6420b9e5fcf79065225bdf937813871a6ef116c7e2b652b98307e4b1613993c71ed5859fd2d22030e927a3bb241ddf803dc7a727e117673bd3f86d040bc8aa9fc3da27519d9fc54303c8e7cc7e3dce37e472203ef32542328aa90ad8955db158a04be0a094dc5e9c7ee10afe639c36541dd29949e966636b2c7390e0620b1a146b15ed4b230f8d7e1dbf4516393b8346dc6220"]}, @typed={0x21, 0xcd, 0x0, 0x0, @binary="97d66ef5a595a441c8dac4777b6e6e9019adcac1585bb1e23e119ef3a0"}, @nested={0x28, 0x5e, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @uid=r3}, @typed={0x14, 0xc6, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @typed={0x8, 0xaa, 0x0, 0x0, @uid=r6}]}, @nested={0x132, 0x12b, 0x0, 0x1, [@nested={0x4, 0xdf}, @nested={0x4, 0x2f}, @generic="bc4b4d5122093fc8589a83ffb70b87a3df35ce3adda27b048ee4bd6c3f626d6c0120f1099c6c78c53fba6cb52a4b2da7a09d9d65f7400aafed1d07b935f59fba718d75e58277ecc08418447a63430abdb2559a584a4411735275d99c5d70b2d5228de1cafb6adbe7701b3cc0b80f83697d826beef2b8a32f71", @nested={0x4, 0x15b}, @typed={0x8, 0x67, 0x0, 0x0, @pid=r7}, @generic="2811b97ae107f64ff90affe4c07eb3de778da1afd546a709b97e13c0b16c5ff4526a35b55e79b76844e9ae845a45858abe1d9eb735d626f5c09f465ea0a5908afb61373cd2fa7ee48b6b3a2a2c2ce895fd5e497dd7795380863c5b0e12572004f2837cec92a295ca72729e1a9cf03865031e0f5cab5f098dc2467275fb2f762ef11acac495074e5eb4cbd6b1945e71bee9df3744c74b3cda17b981784ef624c291"]}, @nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0xcc}, @typed={0x8, 0xe3, 0x0, 0x0, @ipv4=@multicast2}]}]}, @OVS_FLOW_ATTR_UFID_FLAGS={0x8, 0xa, 0x2}, @OVS_FLOW_ATTR_PROBE={0x4}]}, 0x1320}}, 0x0)
executing program 3:
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000000)=ANY=[@ANYRESOCT], 0x44}}, 0x4044000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00'})
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0xf3, 0xb0, @raw=0xfffff038}})
write$auto(0xffffffffffffffff, 0x0, 0xa)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r2, &(0x7f0000000140)={{0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x200002, 0x8}, 0x801}, 0xfffffff9, 0x10, 0x0)
ioctl$auto(r2, 0x8946, 0x24)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r3 = openat2$auto(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x5, 0x4b, 0x4}, 0x8)
mmap$auto(0x0, 0xaaf, 0x4000000000df, 0x40000000000eb1, r3, 0x8000)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x70007fc)
write$auto(r0, 0x0, 0x6)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/ifb0/flags\x00', 0xb02, 0x0)
r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card2/id\x00', 0x200, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r5, &(0x7f0000001280)=""/23, 0xfdfc)
sendfile$auto(r4, r4, 0x0, 0x3)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x2000000, 0x0, 0x10}, 0x4000084)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)
executing program 1:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
write$auto(r0, &(0x7f0000000000)='/dev/loop6\x00', 0x6)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x18dd01, 0x0)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_TUNSETSNDBUF2-process_madvise$auto_MADV_NORMAL-mmap$auto-close_range$auto-socketpair$auto-socket-setsockopt$auto_SO_WIFI_STATUS-openat$auto_usbdev_file_operations_usb-openat$auto_sg_fops_sg-readv$auto-write$auto_sg_fops_sg-ioctl$auto_VHOST_SET_VRING_ADDR2-socket
detailed listing:
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 30, 30, 14, 27, 27, 26, 29, 30, 40, 22, 29, 3, 3, 13, 30, 29, 29, 19, 14, 4, 40, 4, 19, 15, 26, 30, 3, 13, 11]
detailed listing:
executing program 0:
r0 = fsopen$auto(0x0, 0x1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r2, 0x711, 0x70b52c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848)
r3 = socket(0xa, 0x801, 0x84)
r4 = socket(0xa, 0x1, 0x0)
setsockopt$auto(r4, 0x29, 0x37, &(0x7f0000000080)='\x15!\xa8^J/\xddCx4!\x00\xd3\x8f\x1e\x1b\xc3 \xe2\xa8\xd6\xd9\xc0\xa2\x0f\x88\xb1e\x8a\xd8?\xfe\xda\xc4\xef\xff(i\xc6@\x91[\vBj\x0eQ\xce\x16\'C\x8cYA\x92u\xd5\xb8\\\x82,\xe2=y\x9bR\xbcn\xa0c\x16~\x86\"t\xde\x14\xe4\xa5\xfe\xb5', 0x110)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x9c)
fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0)
openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/block/loop6/rqos/wbt/id\x00', 0x101a00, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2000a, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x5, 0x400a)
process_vm_writev$auto(0x0, &(0x7f00000011c0)={&(0x7f00000001c0)="42777dd1330b458d0b5c44ca32e94fc00cfbce962ee7d8f31c0f90c327830f55adfdceafcc0f7b5a21ea23bdf5344d47d49d60218e57bb33118d04fdd37f5fd17f96", 0x8}, 0x7, 0x0, 0x7, 0xb5)
sendmsg$auto_TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000094}, 0x8080)
r5 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, 0x0)
sendmmsg$auto(r5, &(0x7f00000006c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200)="4c0300000000000000a3677337f9eca9075f6bba441b", 0x49}, 0x5, 0x0, 0x5, 0x1}, 0x5}, 0x2, 0x100)
r6 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0)
ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r6, 0x80085502, &(0x7f0000000140)=ANY=[@ANYBLOB="1000006e061e0ec3b417bee1e649c8b817d7a922cb9526d474f20699f1ab6bd6953f82874c6cd0230cb5bf"])
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/ptp/ptp0/n_vclocks\x00', 0x8502, 0x0)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
openat$auto_ext4_dir_operations_ext4(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/bluetooth/hci4/power\x00', 0x20100, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0xfffffffd, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x4000000000007, 0xa505}, 0x800}, 0x4, 0x4008)
executing program 0:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 0:
openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x30db80, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000240)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7fffffff, 0x10)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x1, 0xeb1, 0xfffffffffffffffa, 0x2)
openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000002840)='/sys/kernel/tracing/trace_clock\x00', 0x8000, 0x0)
fchmodat2$auto(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x61ed, 0x4)
r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x60800, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000840)={{@raw=0x8, 0x7, 0xba28, 0x0, "708c58271a7985a7704331f78af8d149fc53d81fd4a7553c2ff48b48a8a57689adcc1ca6d2cbfa93b50590c9", @raw=0x6}, 0x0, @bytes=@data_ptr=0x0, "fa491e08108961dd5708680f1134935851612a52d629535f54f3832490fc4e7f79daef312b3df3307044713a4801d409aefe3f932f78fc311771094e769c0095f94ee6d74f2517f34a0bbbf502bf3392ac4d93bde5f733ba936c0890312cf035bc44117db9b683eedc5e02a703fc82750d8d6ebac0c3019ef8e6c1eecea33a59"})
setsockopt$auto(0xffffffffffffffff, 0x11, 0x66, 0x0, 0x8)
setrlimit$auto(0x5, &(0x7f0000000000)={0x3, 0x4})
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r2)
unshare$auto(0x40000080)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop4\x00', 0x14be02, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r3, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
mlock$auto(0x7c88, 0x7fff)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0x3000000, 0x0, 0x40000000001, 0x0, 0x5}}, 0x100003, 0x9)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/maps\x00', 0x0, 0x0)
pread64$auto(r4, 0x0, 0xeda5, 0xc86)
close_range$auto(0x2, 0x8, 0x3)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto_KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)={0x7, 0x0, [{0x40000001, 0x2, 0x1}]})
getcpu$auto(&(0x7f00000000c0)=0xa51e, &(0x7f0000000140)=0x4800000, &(0x7f0000000180)={[0x5035, 0x2, 0x1, 0x4, 0x9, 0x8001, 0x9, 0x6, 0x9, 0x6, 0x0, 0x1, 0x2, 0x7, 0x4, 0xffffffff]})
socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
executing program 0:
ioctl$auto_NS_GET_TGID_IN_PIDNS(0xffffffffffffffff, 0x8004b709, 0x0)
bpf$auto_BPF_LINK_GET_NEXT_ID(0x1f, &(0x7f00000002c0)=@enable_stats={0x7f}, 0xa6)
sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, 0x0, 0x20008800)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1a/sun\x00', 0x0, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x3, 0x6)
lsm_list_modules$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x401c5820, 0x0)
mkdir$auto(0x0, 0x353)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x5, 0x73)
socket(0xa, 0x1, 0x84)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x13)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/rcutree/parameters/rcu_resched_ns\x00', 0x20000, 0x0)
read$auto(r1, 0x0, 0x20)
socket(0x2, 0x801, 0x106)
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x4000000008000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmsg$auto_MACSEC_CMD_ADD_RXSA(0xffffffffffffffff, 0x0, 0x4008884)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x400000003)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x14, r3, 0x1, 0x70bd31, 0x25dfdbfc}, 0x14}}, 0x24048004)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
r4 = socket(0x2, 0xa, 0x1)
openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ubifs/chk_orphans\x00', 0x426a2, 0x0)
bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_4={0x1f, r4, 0x10000}, 0x10)
executing program 0:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 32:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x3, 0x9)
io_uring_setup$auto(0x1, 0x0) (async)
io_uring_setup$auto(0x1, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
timer_create$auto(0x9, 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa}) (async)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa})
socket(0x2c, 0x3, 0x0) (async)
r2 = socket(0x2c, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'dummy0\x00', <r4=>0x0})
bind$auto(r2, &(0x7f0000000100)=@xdp={0x2c, 0xc, r4, 0x1e}, 0x6b)
sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x200400b0)
r5 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), r0)
sendmsg$auto_NFC_CMD_STOP_POLL(r3, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x40, r5, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x9}, @NFC_ATTR_DEVICE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x1d, 0x14, '/proc/sys/dev/cdrom/info\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x24008001)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x6, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0)
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 1:
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card1\x00', 0x2000, 0x0)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48500, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/003/001\x00', 0x42082, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
memfd_create$auto(&(0x7f0000000040)='A^^\x02\x00\xef\x97\x8aY\x00\x00\xd2\x8c\xb05\x03\\\xb2\xbf247{\xde\t8\f\x00\x00\v\x00\x82\xcc\"K\xe1IIT\x00'/54, 0x5)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0)
r1 = mq_open$auto(0x0, 0xfe, 0x9, 0x0)
socket(0x18, 0x80000, 0x2) (async)
socket(0x18, 0x80000, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2062, 0x0)
write$auto(r2, 0x0, 0x81)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_KSMBD_EVENT_SHUTTING_DOWN(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) (async)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0)
openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x8800, 0x0)
socket(0xa, 0x2, 0x0)
r3 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000001280)='/dev/sequencer2\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4) (async)
r5 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080)
socket(0x28, 0x2, 0x1)
close_range$auto(0x2, 0x8, 0x0) (async)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8, @ANYRES8=r3], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
mmap$auto(0x0, 0xb, 0x6, 0xeb1, 0x3ff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
pipe$auto(0x0)
r2 = socket(0x11, 0x80003, 0x200300)
setsockopt$auto(r2, 0x107, 0x18, 0x0, 0x9)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000940)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="3b3d2abd7000fddbdf250304000008000300", @ANYRES32=r6], 0x28}}, 0x80)
fstat$auto(r3, &(0x7f0000000340)={0x80000001, 0x0, 0xed52, 0x4, <r7=>0xee00, 0xee01, 0x0, 0x5, 0x7fff, 0x0, 0x4, 0x3, 0x5, 0x7, 0x9, 0xfffffffffffffffc, 0x5})
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)={0x12b, r1, 0x1, 0x70bd2f, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_WANTED={0x78, 0x3, 0x0, 0x1, [@nested={0x74, 0x3, 0x0, 0x1, [@nested={0x0, 0x8c, 0x0, 0x1, [@nested={0x0, 0x72, 0x0, 0x1, [@generic="2e14476dec9046786521c57319ac9616fd7cf51cf743ad89449876c7c0607b28c8172bdd62ea012be24b1790e40e414cec12eaea6c6fda1a55835662583a1c57bc4a0f6f29ccf0577db9611988ed14f5920883328b6fd195f34d604d028b"]}, @typed={0x0, 0xde, 0x0, 0x0, @uid=r7}, @generic, @generic="a7f1e130c8bcc7c366885a458370fc86a12dec0c1c00999abe454f1156485fa3207e5591b82f3747eeb017c42ee069ef7d2456a0b96450142ed0331743498b020c0631527e101cd9f2cf97d71444407d364774493bce9ce4f7e5ed65a9c28e9ec92f81ad46e09179edcc6441391918af7ec4290a904da3af9967f1168a7233ac798fc5466894170ce425ff55207ae291ef406ebc69ec6e8e478683d5455bed39f762bdfdc1008b8199c13ef6e664d07f570595462869e5bda41dd195bbfcc20276"]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x4}, @ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x0, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfa03}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xed0}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x10c}}, 0xc881)
executing program 4:
syz_genetlink_get_family_id$auto_net_shaper(0x0, 0xffffffffffffffff)
mmap$auto(0x0, 0x20006, 0xdf, 0xeb1, 0x401, 0x8000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x305c00, 0x0)
setgroups$auto(0xa1, &(0x7f0000000000)=0xc)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto_seq_oss_f_ops_seq_oss(0xffffffffffffffff, &(0x7f0000000c80)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba4291bae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d8", 0xb9)
r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x42, 0x0)
write$auto(r1, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9)
close_range$auto(0x2, 0xa, 0x0)
madvise$auto(0x0, 0x200007, 0x8)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x810)
openat$auto_proc_loginuid_operations_base(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/loginuid\x00', 0x109000, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/irq/11/smp_affinity_list\x00', 0x129542, 0x0)
read$auto(0x3, 0x0, 0xf34)
madvise$auto(0x0, 0x2003f0, 0x15)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/time\x00')
setns(r3, 0x0)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x141002, 0x0)
mmap$auto(0x19, 0x0, 0x7, 0x10, r2, 0x7867)
fsconfig$auto(r2, 0x200001, &(0x7f00000000c0)='\x98\a\x84\x88f8\xe6Gd0\x84@t\x8d%T\x99\xe0\a^\x12\x12\xe6\xce\x81\xd1\xcd\xcfb\xd1*\xdbY\xd6\x14\xb2\xed\x02\xae\'p\xe9\x106\x98\xaa9\xa4P,\xee\xbfQ\xa2\xa0S\xfa', &(0x7f0000000280), 0x0)
lremovexattr$auto(&(0x7f0000000440)='}[,&*}\x00', &(0x7f0000000480)='/de~/bus/usb/001/001\x00')
close_range$auto(0xffffffffffffffff, r3, 0x1b60)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(r4, r0, 0x8)
write$auto(0xca, &(0x7f0000000140)='\x04\x0e\x06\xd5\x89|d\v\x00\x00@\x00\x81\x00\x00\x00\xf6\xf5\x00\xdf\xff\x00', 0x10)
mmap$auto(0x0, 0x402000d, 0xa, 0xeb1, 0x401, 0x8000)
sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="060000", @ANYRES16], 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8a0)
executing program 1:
socket(0x26, 0x80003, 0x854)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_DISCONNECT(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={0x0}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
executing program 1:
mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x40342, 0x149)
openat$auto_ftrace_event_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/events/vmalloc/alloc_vmap_area/filter\x00', 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001480), r0)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f00000003c0)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdc00, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c000}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_NBD_CMD_DISCONNECT(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
r3 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000040), 0x98842, 0x0)
ioctl$auto_PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000080)=0x7)
openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy17/aqm\x00', 0x6180, 0x0)
read$auto(0x3, 0x0, 0x8080)
executing program 2:
openat$auto_proc_tid_children_operations_internal(0xffffffffffffff9c, &(0x7f0000000080), 0x41180, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0)
unshare$auto(0x40000080)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
setresuid$auto(0xffffffffffffffff, 0x0, 0x0)
write$auto(0xffffffffffffffff, 0x0, 0x100000a3d9)
pread64$auto(r0, &(0x7f0000000100)='\x00', 0xa7, 0x5)
mmap$auto(0x0, 0x2020009, 0x5, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x2003f2, 0x15)
syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x24048084)
madvise$auto(0x0, 0x200007, 0x19)
syslog$auto(0x3, &(0x7f0000000080)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0x5)
mmap$auto(0x0, 0x400008, 0xdf, 0x4000000000009b72, 0x2, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x801, 0x84)
r1 = getpid()
process_vm_readv$auto(r1, &(0x7f0000000000)={0x0, 0xfff}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000280)="8618c61e", 0x40000000001243}, 0xa, 0x0)
setsockopt$auto(0x3, 0x0, 0x4, 0x0, 0x28)
sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3)
sched_getattr$auto(0x0, &(0x7f0000000000)={0xcf86, 0x6, 0x6, 0x200, 0x7, 0xb, 0x6, 0xfffffffffffffff8, 0x8, 0x90}, 0x68, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0x8000000000000000, 0x15)
brk$auto(0x40008000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000280)='/proc/asound/modules\x00', 0x88400, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r2, &(0x7f0000000040)=""/209, 0xd1)
socket(0x200000000000011, 0x2, 0x1)
executing program 3:
mmap$auto(0x100000000, 0x2000d, 0x1, 0xeb1, 0xffffffffffffffff, 0x100000000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty17\x00', 0x1, 0x0)
semget$auto(0x0, 0x13c, 0x1ff)
recvmmsg$auto(0xffffffffffffffff, &(0x7f00000001c0)={{0x0, 0x5, 0x0, 0x9, 0x0, 0x800000000005, 0x7ffffffd}, 0x8}, 0x3, 0x1, 0x0)
semtimedop$auto(0x0, &(0x7f0000000140)={0x7, 0x81, 0x70}, 0x1f4, 0x0)
r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r1 = openat2$auto(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)={0x982, 0x6, 0x4}, 0x7f)
r2 = syz_genetlink_get_family_id$auto_802_15_4_mac(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$auto_IEEE802154_ADD_IFACE(r1, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00012a000b000900000005002800d4000000060010006a05001d004000"/46], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x525a05df5b8ef67a)
ioctl$auto_SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0)
socket(0x1e, 0x80000, 0x9)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptye9\x00', 0x101e81, 0x0)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x2c402, 0x0)
r4 = ioctl$auto_TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, &(0x7f0000000180)=0x10)
write$auto_dev_fops_plock(r4, &(0x7f0000000200)="ea579eafbef6a78ace20c66c3ed28a307811ba5a77e0d6f20eee070874ce267321ef2da8ccef77a2a57912658cfac38b23199ba898ef2c29ea039494e108e23fc3d3de801c6cdb8c585be1ec026d327ad05a0c7812805bb6d050f902f2e77e549ec276c282a2bb8c2847f2e7105018d493a4a1dc", 0x74)
r5 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000980)='/dev/ttye9\x00', 0x102, 0x0)
rseq$auto(&(0x7f0000000300)={0xe, 0x401, 0x0, 0x6, 0xffffffff, 0x2}, 0x8000, 0x0, 0x6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x16, 0x21, 0x6, 0xfffffffffffffffe, 0x5)
sendfile$auto(r5, r3, 0x0, 0x1fff5)
close_range$auto(0x2, 0x8, 0x0)
r6 = openat$auto_nsim_dev_trap_fa_cookie_fops_dev(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/netdevsim/netdevsim6/trap_flow_action_cookie\x00', 0x4, 0x0)
io_uring_setup$auto(0x1, &(0x7f00000004c0)={0x7, 0x400, 0x3, 0x8, 0x9, 0x7, r6, [0xe, 0x80, 0x101], {0x1ff, 0x800, 0x5, 0x3, 0x4, 0x2, 0x0, 0x0, 0x9}, {0x1ead, 0x10, 0x5, 0x5, 0x5, 0x7, 0xa2f, 0x42e646f9, 0x1}})
semctl$auto_GETNCNT(0x0, 0x4, 0xe, 0x4)
io_uring_setup$auto(0x4bf15e08, 0x0)
bpf$auto(0x12, &(0x7f0000000040)=@enable_stats={0x1}, 0x26)
recvfrom$auto(0x4, 0x0, 0x101d0, 0x3ffffd, 0x0, 0x0)
unshare$auto(0x40000080)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x40000008000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda1\x00', 0x4040, 0x0)
mmap$auto(0x0, 0x400008, 0x8, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/ptp/ptp0/max_adjustment\x00', 0x168040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x2020009, 0x203, 0xeb1, 0xfffffffffffffffa, 0x8000)
unshare$auto(0x40000080)
dup2$auto(r1, 0xffffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xc18260, 0x0)
ioctl$auto(0x3, 0x800005411, 0x38)
sendmsg$auto_IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x4044000)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
socket(0x26, 0x800, 0x8)
read$auto(0x3, 0x0, 0x7fffffff)
mmap$auto(0x0, 0x2020009, 0x6, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0xffffffffffffffff, 0x8, 0x0)
sysfs$auto(0x2, 0x4000007, 0xfffffffffffffffc)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
write$auto(0xca, 0x0, 0x83)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x27ffe)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, 0x0, 0x208000, 0x0)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x18b800, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x1000, 0x2)
mbind$auto(0x0, 0x8000000000000001, 0x6, &(0x7f00000000c0)=0xffffffff, 0x7, 0x3)
ioctl$auto_SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0)
capget$auto(0x0, 0xfffffffffffffffe)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x800, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000)
r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000440)='/proc/fs/cifs/DebugData\x00', 0x2000, 0x0)
pread64$auto(r1, &(0x7f0000000040)='/proc/scsi/sg/devices\x00', 0x10001, 0x3)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
prctl$auto(0x3e, 0x801, 0x0, 0x1, 0x2)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x1102, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x5, 0x8000)
executing program 3:
unshare$auto(0x40000080)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
r1 = prctl$auto_PR_SET_MM_ARG_START(0x0, 0x8, 0x0, 0xacb, 0xfffffffffffffe01)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_SW_SYNC_GET_DEADLINE(r1, 0xc0105702, &(0x7f0000000000)={0xa6fe, 0x0, <r2=>r0})
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000180), r1)
sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x100, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004983}, 0x20000040)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptya7\x00', 0x101e81, 0x0)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
io_uring_register$auto(r4, 0x9, &(0x7f00000001c0)="c36736685c38b88292237ee11f7a94d988b9b0d4ef73b9765aa881edbd0301d50b67502ee2a9243e5e2db48d15c22ced4fb53def384399f9de63bc7cc7800169e12f7f6a54982e5c3987d8f044edb7abc42eda929e496f783fb572edac35025ba22aa46ede59f3eb236a481cbc6ed26372315f7ff7b1d173ea8ac334380ada4447d2918637e5359302db30603bfb9456e50f2c67bd982c16d208d9c0de1c354135b398ea88bee6e55110e84870bbe598856e765961a13a3d7bcecfbd381ab62752edbb09ac19af7b5f27f2fed7dd1966da821d2cfd1795c4db38c890a9aa1fa1610bdade665c194218d58eae4af9357015e8", 0x3)
sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07)
read$auto(0x3, 0x0, 0x7fffffff)
executing program 3:
r0 = openat$auto_binder_features_fops_(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binderfs/features/freeze_notification\x00', 0x141000, 0x0)
pread64$auto(r0, 0x0, 0x2, 0x7a)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
executing program 3:
openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0) (async)
r0 = openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0)
write$auto(r0, &(0x7f0000000080)=',}#-#-}}\x00', 0xe6)
openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4) (async)
r1 = openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4)
ioctl$auto_RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000100)={0xfffffffd, 0x4b, 0x0, 0x8, 0xfffffff9, 0x3, 0x9, 0x1000, 0xfffffe00})
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200) (async)
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200)
clock_nanosleep$auto(0x3, 0x0, &(0x7f0000000180), &(0x7f00000001c0)={0x7, 0x75})
openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
pselect6$auto(0x7f, &(0x7f0000000240)={[0x9bb, 0x9, 0x2da3, 0x5, 0x80000001, 0x8, 0x4, 0x7f, 0x2, 0x61, 0x948, 0x6, 0x0, 0x8, 0x80, 0xffffffff]}, &(0x7f00000002c0)={[0xffffffffffffffff, 0xfffffffffffff5e9, 0x1000, 0xffff, 0xfffffffffffffffe, 0x200, 0x8000000000000000, 0x0, 0x6, 0x4, 0x2, 0x0, 0x6, 0x0, 0x17d9ec6d, 0x25b6]}, &(0x7f0000000340)={[0x4, 0xaa, 0x8, 0x4, 0x6, 0x80000000, 0x1, 0x0, 0x8, 0xfc, 0x2, 0x2, 0x1, 0x101, 0x0, 0x7]}, &(0x7f00000003c0)={0x9, 0xffffffffffffff42}, &(0x7f0000000400)="70bbc9eb0bf0c11539c987617cf2d4be5550703972db7a11cd25afacd1f687461bd4bf3452e7d76662a191301d7b003e5cbc13809abd6b56432d5e3bb66950b5d83767caf6d0003987f2784033244b4ab49ed17f17c53adb357ac4186dbe4fc53a0fd13404a9dd364c16373f4f89e051798f53780aba296d3c40fbf4499c4ef95a781498")
syz_genetlink_get_family_id$auto_nfsd(&(0x7f00000004c0), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
nanosleep$auto(&(0x7f0000000500)={0x8, 0x3}, &(0x7f0000000540)={0x10001, 0x5})
mq_timedsend$auto(r2, &(0x7f0000000580)='nfsd\x00', 0x4, 0x9, &(0x7f00000005c0)={0x9d, 0x10000})
io_pgetevents$auto(0xb, 0x7, 0x8, &(0x7f0000000600)={0x3, 0xfffffffffffffff9, 0x7, 0x9}, &(0x7f0000000640)={0x1, 0x41}, &(0x7f00000006c0)={&(0x7f0000000680)={0x6}})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_XFS_IOC_ALLOCSP64(r1, 0x40305824, &(0x7f0000000740)={0x1c3, 0x1, 0x1, 0x4, 0xd, <r4=>0x0})
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async)
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000880), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'nr0\x00', <r6=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'veth0_to_batadv\x00', <r7=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000940)={'ip6tnl0\x00', <r8=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00', <r9=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00', <r10=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000a40)={'team0\x00', <r12=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00', <r13=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ac0)={'pim6reg0\x00', <r14=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000b00)={'ipvlan1\x00', <r15=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00', <r16=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00', <r17=>0x0})
sendmsg$auto_ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000e80)={&(0x7f0000000840), 0xc, &(0x7f0000000e40)={&(0x7f0000000bc0)={0x244, r5, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_FEATURES_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @ETHTOOL_A_FEATURES_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfff}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xf9d}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3f5cc39}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}, @ETHTOOL_A_FEATURES_HEADER={0xa0, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7ff}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x841}, 0x4000)
executing program 4:
r0 = openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000006900)='/sys/kernel/config/target/dbroot\x00', 0x189002, 0x0)
write$auto(r0, &(0x7f0000000100)='/dev/audio1\x00', 0x100000a3d7) (async)
r1 = mq_open$auto(&(0x7f0000000000)='\'\x00', 0x1, 0x8, &(0x7f0000000040)={0x5, 0xff, 0x80, 0x1})
io_submit$auto(0x8, 0x5, &(0x7f00000000c0)=&(0x7f0000000080)={0x6100000, 0x7, 0xc, 0x0, 0x9, r0, 0xffffffffffffff00, 0xfffffffffffffb13, 0x4, 0x0, 0x4, r1})
executing program 3:
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x3)
mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read$auto_rng_chrdev_ops_core(0xffffffffffffffff, &(0x7f0000000040)=""/4096, 0xfffffe82)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0xc8600, 0x0)
getdents$auto(0xffffffffffffffff, 0x0, 0x400018)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_CONNECT(r0, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x8880)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
executing program 4:
r0 = socket(0xa, 0x80003, 0x3a)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
r1 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_OVS_FLOW_CMD_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdc02, {}, [@OVS_FLOW_ATTR_PROBE={0x4}, @OVS_FLOW_ATTR_KEY={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xf, 0x0, 0x1, [@generic="99cb9d0ac5e7ca3d"]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040071}, 0x800)
r3 = setfsuid$auto(0xee00)
r4 = setfsuid$auto(0xee01)
setresuid$auto(r3, r4, r3)
r5 = setfsuid$auto(0xee00)
r6 = setfsuid$auto(0xee01)
setresuid$auto(r5, r6, r5)
r7 = getpid()
process_vm_readv$auto(r7, &(0x7f0000000100)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xf}, 0x6, 0x0)
sendmsg$auto_OVS_FLOW_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001380)={&(0x7f0000000040)={0x1320, r1, 0x4, 0x70bd2c, 0x10000, {}, [@OVS_FLOW_ATTR_MASK={0x12fe, 0x7, 0x0, 0x1, [@typed={0x14, 0x3, 0x0, 0x0, @ipv6=@loopback}, @generic="c30fd0c4f7597fbfb0395890c0bc9741a0af52d26458c9fa9584426c5c5a5a0bf0a4aeb8185d1c4ec803949f5da3d3f5ec37c1144169df1312bf11f928e3f955e65e7c1df1dbe18dd602320e4bd1b2636ddefef6a4ef0e01f7b4ec9ba409b419fcda6a76d02d56d5211100409932ec6c23d7fe823b3fd9a73e56c2bdbe6b0c9de91794349ff4f592b6a66916c6e8463fcde18f195e1b677234d8dca114ad56f53978648df5505d30260365d3edcca96749e87cc7fb7702030b2d0a9e906b07a22da839f1", @generic="d68df5687673c9f7015038865f1e65da7b087cd198617491ee3b595b65cca24c40f7e28afc45b5ebc9d4bfa432b7f2f562865ee5e973886bfe3bdf20ec4ceefcd4c0c2ec7d62e64e545fe6e810712ebf963e4038", @typed={0x8, 0x6d, 0x0, 0x0, @fd=r0}, @generic="5741e1a026549d8bc5d2fd54cc5e4a4eeaec664c2c15fd6b6acd4bc09c6ba77439885bb2b7f24fb594c407fbc157116664fd", @nested={0x1004, 0xe1, 0x0, 0x1, [@generic="fdc2ac8797fd5123fb8f054a89f2a6053181f6d17b5d173169fa3ddad5f3d657523615d068a17f890ff94fe2875c4e3ddb3a62740ed7631f81a5ca800c02fbd9e77ac612d5274297e0f54bc72818543ea539da64e161c8de7e04254c77d7456c5ed9d3d7fdaff775b61300fbe7abb09a5056f08a782617c3dd2c1dae24155379e4b5a92043e52b7e40afb890ac5fbb6b8f1036e31b916b99f255d1b28d895208e1797e216d7567873e870e6872c84b630378318614e3d6727f39988a3d6150b7fa961f78dce67e8e4cef3f666526e4770ef47b6caed08ad1379af68fc2b7df94b5d9bcceb862875da3010893c343a322350a4c1dfe4b6a837be9a835547540535117cdfea59da934381947df85a55b7541591c069288a200db14ed229851f53aa58f24c9c76794d945aa641cede8b3e8517a190f264e00fca600d431705e5f814b270c14d87cb561162594d98103b6e8758c837b2cd102ad0db123a29c492a547f3f6cc7d00539c760b944fef4b62e072a1d45e075e6c78ca95507f58e9e521ab1163e36ca4507a6dd3b47842058ee2f1af962ff157c5e900c35ff15c1d362203f7ddcdf4b657ae761edcdd3b699b65da671e586c39b1da178c871623effbdb3d976412987651b5dd19d9e730646de22505c0ab0661740daf419928ca75c096e7353aa663683902f03ef8cecf24915c47d296128ccf441a74af0ef05678306909f97f09b725e315293ec1867cb92b57843c74dbfa8b1d070fe46e723b3d39a055873b15ee832aef79d67d9bf20ed1d5484f37910301393aad6b1143168ae841f8fc5b4a16ad905f24b5c9599386c1fb692b28b090dbae26a512cb0a4b0b4d7b4aa21131b797ef5fd3d13fbac94434e5bd57510e725e737a2c29d941af2cb0e813d40eeae81f570d685f9388f52dcdb2d54138a4d0e2d65884ba7bb53861c32d6a9e10c382658143e8557fd282d1511075a19e1be411443f8ec863a44abfc0615377949e335bb11d3b478c4590eee9a0e0aca01ba4f9f28f989ef4cc38959bfc3d7f97c4e969296818aada93eeb62c8997faa37c5f8a11d8284d5a21a754451f63efb4acf9d347b802f585862cdb2e60909d11d057e49d0b18c2c7756c91c4ab00e623f2aa627401d5f3eac4c4a984ba8fad3e05f2e7304e69194f69c77ff82d32d41c23272b77137abde44d8750cd0b929dce3b2edd55c81dcf491e90e79c071cd60b030a7b6ee1a83990c36490b2a190ec728a5a31b7ed1112a3694fd8a7df3eafa3fd74fbac17d4c26ba8102a6b45ffc574f15fd82f116d7592ba8edb15d2754602863c9c48f7baee0813d563d04a8622d5d390a290521f0a8f99a71586a9046c6e1b2c37adba3b230852ffada0330337c5abecafc47bb29bb6e52f760084c244800cbff56450534d1736d1b7789dabd3af891caf422a2b78ac26b114e8307165c8a832b72897e6f51a959b42ca2f76824810e6bbbd5f349a0bb96628b66c0804bfaa56a9aa6a24e2a9f7d9ca83e9a0c1913a641e6023536f1cb54a95307bffca43a16e2bea208d51e80e8e58cc4fffc8f6a8f26b45fbc279be3ab5b7b9c6f511a7855101f28f06df45b5d7cc4f103391b2059e27827ed616bbcc009e310838cbf2511d852121b38ebea56821ade02e7640a6febe264972e6158223087c54424b0f8b9ee02743c736cf364140c67f0d9df6a351dab2ee0a85f8431f12ef1afca7549d6b7ff264235ec548eddc0b3400557ad069afa1c9e40464b78fa095b4170212adbb33ad2cdb4614ac02fd38e5d60af960ff964df91acf024f9894e4d33bcc9721fe9df33a8fab4b2f0812355dd21f81acb976e6a7505aa965555bb42d971b207b7ca7c8e896c0ef9ca85fd9a708a82054a44929330929aee29d75c6b16948867a938d7688ce2e030b6b771ed8769336a32b8ff4127dd7739f62d368303fb475f07c3a1358e1480feb15e4284a6416f1ff69ee1d0b41ce44a257ac67500667945c6812295862b0db70658548c0a576c1f5384dc39a4b02e87615604ee0c44aa967d265d1a0f767239cd2e0041ef200863e68e4b835130055601ddd47e35518a1011ec0cc6b279b495cd3d1c470076f31bedf235d1386d6b8052185ab49e3a442ffdc05b7769c4fbc84d1fae685898c036275da551aa26e00a38728dfae2be88125fd388e08e712d2d7b378ef7b06119027c48ef012450f44f2448ecb39ca403abde4673111da68bd9912f58ec7555cb70d2b41137b845db61f12b8d4abfb98b4d04a18a97c70105080aa0603629508d1a329e5b7a1f16a44c42053a7904e3f4b695a5417db17887d0ee23cf2eec277d55cac398957e2ed017613dc50305f13b148a9045841edfbc62e7cdb9618119791f87ad8357cb78f762615a601488af9183021227e50ec330176dee1a04ea9bae39bd31851942ab591e9548cb709209985d7305b73bf1458c62d3c6cfd8b75071e3f28913f9271d36749fb14e9fd4bf9b05f3400551092457c2036df75d9c0345b41bdf25f2a5ca1d1df8d5e5f28d089179252ad2e1c41619441e45d97dd4c228be300a026988edf65f1eaa283dc126aaf0ba7c6f323610a5822ce5fc2cb9f4520a45d863115264f103d49a8b995d9780a7240c87deec19909c91c4b9ebab6e4f9a4669801c44b825ff9158ee94f3f2c3ac0311d20374d4c995cd655a179bfcfebf4e0410b7835b0fdd25a965a8a09e2f341f475222018d289a9c5fd7368d87f686591d247516b9cde5394339cff50a8122585f150f3aaca8ae19d247e87dbc1ac43b02534ec386fd2744a3711eff31fbb6fd5e66142dc2aa0b7dd8cd71b101298ffc55d56b58d690b2dd993bd03e30963764151f992535d53ccdf43d58f640dfef8ad079aa0138abb818085b03a14699c2da78fa34691804ea4cf916d413956b770870ae2312ca6d1b22f3c30fcf5ed33aaa3cd0b4e33c83c39c3bf229b3b54198e3f04da79fa291f89b879a9b67fe244fcaa150ccd64e2c3f238202e3311dcea805c95d3105cc23c80e1ebf9ca93381af6ecf490f8e72e5a136204f9ef50df540f5f312f6546824eedeba19f7bc9ea8dc06c2152d5d0e34a00c7e95dbfe6c0f01e9317e0a68ddef1ac52aa996ef19d5fa27e3b5ec761cc2d7869a7962208224b3c1b3d93526def8eab3534c4bcc7172af697d8004c74a56eb4a13d25e457c87c67995f4e542fdda0b4942dbd362ed16b42041daf44a1438777f96fabdeab74f1de4e86ceb121c9736962e08c60888c4e101b1b5876e325018a6330c459f4f7f57f460913ce0c23699331769a8deacf2df7cbfaca0699f2d40e2f1cb7a604042c5c4be36f8d119b12274eadac6e84fba35d8e94157cbf764946593e4369eadb23f2fef94f697f36b251409758fecc397f4d3d8ab22481f11420de89c935fd1f1b2b97038d2fd84d2044b5f5d11c4a0feb0bd64254806faeb50d3dae6d3ec0ea8edb56ad368914f12083a9818f2737f14330e70106b23f87980df7f1554053fb31c64a800faa49c1b532f742e6d55e32f28c493b74e0af074c6500e6be748ca31c1b37a340360d6277c95b0bb73fc75b1a60dcbb8f6736b98766a2078695a58736fd144b6f1ae17fa72bab965f0c76bdaa87dfaf8a697bacab009de168582224dffe455ff790e6b5a94bc18510c779b057cb55a74bfff8aceb47100881baa083cef35522b0476f9510ad91ec109abf678a7dae3585b2da6557e17b243d107c83e44065293438f77b07c9dc096857c386f8db72924fd0e9bddb81f2bdd8925583aa06582fcbdecb53b3335d1f76bf2320c9cee8a241b0f80486f3f3d8811c60638e1a00a0cc5ea97f286d76d754ed1105d738f0537aab6be8f358b3c7c4a1042281afd6ca2163747c1879e9e1bbe8887ee22ebadb78e6c893d52747f13237a4b24241bd6890bb62ede528069052786f0a73883c9a79211957634fb2b8bbadf0c769bd88cd520d362865da014b768822f539a5386312c0d70ee800c341c8672eb1e9b5b562f1e8590a47d045529e2f7f5d2b77c6459c6c36457a4a88f779789fe617f12aa40b7bcd99617f64dd4eb08c0bc5c300f467519ae71d1a0d4dbacc1fb145c8f47cf6a78c4dcecac1f784c59cbaa40f5bcda0176df9057afaa0536d4fc8f63ee486505c0453510cf88d4bc361737b65f1122665d19f51e25004c57ab35f8d05a2582f634c0a3bc5a1a047160803b11cae161d8bc4e2c5719bca313fb844f8c6323fbce9d22e3a43e01cc690da736fbf2a88eea35498ace6f3a327b907a39a8922480b4123f8e89b1d191d8c478fbe189401f9005a17eb12d673cf2352ede5ca2573239e2249db0cd131efe39f43f840be8f7f9194ce265dcb568bda7364bb8425380d5c928c41ef53aa1716aa113e22f12a5390ffa56f58c6f3d71ad29b68631b067ba9debe1ec546403730c3ba56f4acba0b323544f01386fb62e447b308ea1e600f48d13202b8a06c4a3179ca3915788ee66244375e6cac2a5fa6ea6ca8e95f535e86cd0744d6f01b67cd2da7945be620865908ef9a71158a47ec572076d098b169860ae24cf3ce70af74d23ddd3b4b280b09c8a3fba6f9eeb0b3a9ec542645e25f14f6ccbca18b041204b6b1207b58820096a7bda02cf1c8bf1c147479b7eef667ba0717cbfa066a525ad9c162832b7408f355aaecdc739e358defd599bec95060a28f828561fa2b50e0293a26d61d901e9f7715a29ed495e2e40610e3cf0aefe2f41dad38004f874f04496583765f9e1ed5f077a389e095e1cbc8ec62fb9b91e5b67ed4cd65e9297c36154613a50d843794f1420dd17e01ee28082d67dfb20eb7315a9b2f015efd7395e98168315d2130d657c942d60a68c378f3537ffe886a674f7c9c1793bf4a59df0405d47f2efbcf94dc4741cdde698407b34598cefff1ac43e27a6f0f4e544ac3f81ce377c4f003047d17fc5a41893ccf262806d1b831df9747977ebdae7ea45d6e4debafe3e5f9bd1e0c37b741ee7161ddacf00501b8ee14f9f8baa8ba4d9c109f9fea7ada055c395958fa2c0ecbe515ba66d714db5ad7550d91708e8cbab43d91a0f247d4e6dc25954504213c3b6b193521f05915da79e0bdb16992bbab36cd5775d01e57f983478cba942bb3773046a7e3eeb5ce6aef42ced902c0a30e12394b8704f70d94924fde69e793e9b84cdf240b103918211259dedc5edf135df57d7bf07e266f31a04bff80f8fa57dac7f6faa5058d796a7dd36299a8a680218f6d9a31867128dc0b66e4dbe4de8796552c6a6c78ef85aa959e42eb0c980e05aa47b20a3a4578fb23d198e28de5fab14882870106f1e7c448e4368fd0acb68bcaa6895f3d7f50aea413ce96042ae80e258eca17374af3326cc6b462d337c2b9ab9f197208d6358801e7048469d0230229e3310660732c439b571b965cc89cbe30b74387a2124ce654a008f9486a6d4d6e5e29e5c7382a240bd2f241e68f255e3021ca659d58db2671219e6dee6b6b6ab74b31d13dbf04bfa38a6f58b49a9605c21a081a771a29c76e34fdbbb5866ed88c020ee535ce576e3711c253dbd1cf3aa876094ad13dd926c0997f716b2374f6420b9e5fcf79065225bdf937813871a6ef116c7e2b652b98307e4b1613993c71ed5859fd2d22030e927a3bb241ddf803dc7a727e117673bd3f86d040bc8aa9fc3da27519d9fc54303c8e7cc7e3dce37e472203ef32542328aa90ad8955db158a04be0a094dc5e9c7ee10afe639c36541dd29949e966636b2c7390e0620b1a146b15ed4b230f8d7e1dbf4516393b8346dc6220"]}, @typed={0x21, 0xcd, 0x0, 0x0, @binary="97d66ef5a595a441c8dac4777b6e6e9019adcac1585bb1e23e119ef3a0"}, @nested={0x28, 0x5e, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @uid=r3}, @typed={0x14, 0xc6, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @typed={0x8, 0xaa, 0x0, 0x0, @uid=r6}]}, @nested={0x132, 0x12b, 0x0, 0x1, [@nested={0x4, 0xdf}, @nested={0x4, 0x2f}, @generic="bc4b4d5122093fc8589a83ffb70b87a3df35ce3adda27b048ee4bd6c3f626d6c0120f1099c6c78c53fba6cb52a4b2da7a09d9d65f7400aafed1d07b935f59fba718d75e58277ecc08418447a63430abdb2559a584a4411735275d99c5d70b2d5228de1cafb6adbe7701b3cc0b80f83697d826beef2b8a32f71", @nested={0x4, 0x15b}, @typed={0x8, 0x67, 0x0, 0x0, @pid=r7}, @generic="2811b97ae107f64ff90affe4c07eb3de778da1afd546a709b97e13c0b16c5ff4526a35b55e79b76844e9ae845a45858abe1d9eb735d626f5c09f465ea0a5908afb61373cd2fa7ee48b6b3a2a2c2ce895fd5e497dd7795380863c5b0e12572004f2837cec92a295ca72729e1a9cf03865031e0f5cab5f098dc2467275fb2f762ef11acac495074e5eb4cbd6b1945e71bee9df3744c74b3cda17b981784ef624c291"]}, @nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0xcc}, @typed={0x8, 0xe3, 0x0, 0x0, @ipv4=@multicast2}]}]}, @OVS_FLOW_ATTR_UFID_FLAGS={0x8, 0xa, 0x2}, @OVS_FLOW_ATTR_PROBE={0x4}]}, 0x1320}}, 0x0)
executing program 3:
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000000)=ANY=[@ANYRESOCT], 0x44}}, 0x4044000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00'})
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0xf3, 0xb0, @raw=0xfffff038}})
write$auto(0xffffffffffffffff, 0x0, 0xa)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r2, &(0x7f0000000140)={{0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x200002, 0x8}, 0x801}, 0xfffffff9, 0x10, 0x0)
ioctl$auto(r2, 0x8946, 0x24)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r3 = openat2$auto(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x5, 0x4b, 0x4}, 0x8)
mmap$auto(0x0, 0xaaf, 0x4000000000df, 0x40000000000eb1, r3, 0x8000)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x70007fc)
write$auto(r0, 0x0, 0x6)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/ifb0/flags\x00', 0xb02, 0x0)
r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card2/id\x00', 0x200, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r5, &(0x7f0000001280)=""/23, 0xfdfc)
sendfile$auto(r4, r4, 0x0, 0x3)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x2000000, 0x0, 0x10}, 0x4000084)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)
executing program 1:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
write$auto(r0, &(0x7f0000000000)='/dev/loop6\x00', 0x6)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x18dd01, 0x0)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: bisecting 31 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 22, 29, 3, 3, 13, 30, 29, 29, 19, 14, 4, 40, 4, 19, 15, 26, 30, 3, 13, 11]
detailed listing:
executing program 1:
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card1\x00', 0x2000, 0x0)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48500, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/003/001\x00', 0x42082, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
memfd_create$auto(&(0x7f0000000040)='A^^\x02\x00\xef\x97\x8aY\x00\x00\xd2\x8c\xb05\x03\\\xb2\xbf247{\xde\t8\f\x00\x00\v\x00\x82\xcc\"K\xe1IIT\x00'/54, 0x5)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r0, 0x0, 0x8080)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0)
r1 = mq_open$auto(0x0, 0xfe, 0x9, 0x0)
socket(0x18, 0x80000, 0x2) (async)
socket(0x18, 0x80000, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2062, 0x0)
write$auto(r2, 0x0, 0x81)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_KSMBD_EVENT_SHUTTING_DOWN(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) (async)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0)
openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x8800, 0x0)
socket(0xa, 0x2, 0x0)
r3 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000001280)='/dev/sequencer2\x00', 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4) (async)
r5 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), r4)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080) (async)
sendmsg$auto_BATADV_CMD_TP_METER(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, r5, 0x77bed28568c43d3b, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}]}, 0x28}, 0x1, 0x100000001000000, 0x0, 0x2019}, 0x8080)
socket(0x28, 0x2, 0x1)
close_range$auto(0x2, 0x8, 0x0) (async)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8, @ANYRES8=r3], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
mmap$auto(0x0, 0xb, 0x6, 0xeb1, 0x3ff, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
pipe$auto(0x0)
r2 = socket(0x11, 0x80003, 0x200300)
setsockopt$auto(r2, 0x107, 0x18, 0x0, 0x9)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000180), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000940)={'batadv0\x00', <r6=>0x0})
sendmsg$auto_BATADV_CMD_TP_METER(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="3b3d2abd7000fddbdf250304000008000300", @ANYRES32=r6], 0x28}}, 0x80)
fstat$auto(r3, &(0x7f0000000340)={0x80000001, 0x0, 0xed52, 0x4, <r7=>0xee00, 0xee01, 0x0, 0x5, 0x7fff, 0x0, 0x4, 0x3, 0x5, 0x7, 0x9, 0xfffffffffffffffc, 0x5})
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)={0x12b, r1, 0x1, 0x70bd2f, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_WANTED={0x78, 0x3, 0x0, 0x1, [@nested={0x74, 0x3, 0x0, 0x1, [@nested={0x0, 0x8c, 0x0, 0x1, [@nested={0x0, 0x72, 0x0, 0x1, [@generic="2e14476dec9046786521c57319ac9616fd7cf51cf743ad89449876c7c0607b28c8172bdd62ea012be24b1790e40e414cec12eaea6c6fda1a55835662583a1c57bc4a0f6f29ccf0577db9611988ed14f5920883328b6fd195f34d604d028b"]}, @typed={0x0, 0xde, 0x0, 0x0, @uid=r7}, @generic, @generic="a7f1e130c8bcc7c366885a458370fc86a12dec0c1c00999abe454f1156485fa3207e5591b82f3747eeb017c42ee069ef7d2456a0b96450142ed0331743498b020c0631527e101cd9f2cf97d71444407d364774493bce9ce4f7e5ed65a9c28e9ec92f81ad46e09179edcc6441391918af7ec4290a904da3af9967f1168a7233ac798fc5466894170ce425ff55207ae291ef406ebc69ec6e8e478683d5455bed39f762bdfdc1008b8199c13ef6e664d07f570595462869e5bda41dd195bbfcc20276"]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x4}, @ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x0, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfa03}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xed0}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x10c}}, 0xc881)
executing program 4:
syz_genetlink_get_family_id$auto_net_shaper(0x0, 0xffffffffffffffff)
mmap$auto(0x0, 0x20006, 0xdf, 0xeb1, 0x401, 0x8000)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x305c00, 0x0)
setgroups$auto(0xa1, &(0x7f0000000000)=0xc)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
write$auto_seq_oss_f_ops_seq_oss(0xffffffffffffffff, &(0x7f0000000c80)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba4291bae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d8", 0xb9)
r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x42, 0x0)
write$auto(r1, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9)
close_range$auto(0x2, 0xa, 0x0)
madvise$auto(0x0, 0x200007, 0x8)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x810)
openat$auto_proc_loginuid_operations_base(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/loginuid\x00', 0x109000, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/irq/11/smp_affinity_list\x00', 0x129542, 0x0)
read$auto(0x3, 0x0, 0xf34)
madvise$auto(0x0, 0x2003f0, 0x15)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/time\x00')
setns(r3, 0x0)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x141002, 0x0)
mmap$auto(0x19, 0x0, 0x7, 0x10, r2, 0x7867)
fsconfig$auto(r2, 0x200001, &(0x7f00000000c0)='\x98\a\x84\x88f8\xe6Gd0\x84@t\x8d%T\x99\xe0\a^\x12\x12\xe6\xce\x81\xd1\xcd\xcfb\xd1*\xdbY\xd6\x14\xb2\xed\x02\xae\'p\xe9\x106\x98\xaa9\xa4P,\xee\xbfQ\xa2\xa0S\xfa', &(0x7f0000000280), 0x0)
lremovexattr$auto(&(0x7f0000000440)='}[,&*}\x00', &(0x7f0000000480)='/de~/bus/usb/001/001\x00')
close_range$auto(0xffffffffffffffff, r3, 0x1b60)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(r4, r0, 0x8)
write$auto(0xca, &(0x7f0000000140)='\x04\x0e\x06\xd5\x89|d\v\x00\x00@\x00\x81\x00\x00\x00\xf6\xf5\x00\xdf\xff\x00', 0x10)
mmap$auto(0x0, 0x402000d, 0xa, 0xeb1, 0x401, 0x8000)
sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="060000", @ANYRES16], 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x8a0)
executing program 1:
socket(0x26, 0x80003, 0x854)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_DISCONNECT(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={0x0}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
executing program 1:
mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x40342, 0x149)
openat$auto_ftrace_event_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/events/vmalloc/alloc_vmap_area/filter\x00', 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001480), r0)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f00000003c0)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdc00, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c000}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_NBD_CMD_DISCONNECT(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000000240)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x2004c890)
r3 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000040), 0x98842, 0x0)
ioctl$auto_PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000080)=0x7)
openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy17/aqm\x00', 0x6180, 0x0)
read$auto(0x3, 0x0, 0x8080)
executing program 2:
openat$auto_proc_tid_children_operations_internal(0xffffffffffffff9c, &(0x7f0000000080), 0x41180, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0)
unshare$auto(0x40000080)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
setresuid$auto(0xffffffffffffffff, 0x0, 0x0)
write$auto(0xffffffffffffffff, 0x0, 0x100000a3d9)
pread64$auto(r0, &(0x7f0000000100)='\x00', 0xa7, 0x5)
mmap$auto(0x0, 0x2020009, 0x5, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
madvise$auto(0x0, 0x2003f2, 0x15)
syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x24048084)
madvise$auto(0x0, 0x200007, 0x19)
syslog$auto(0x3, &(0x7f0000000080)='..\x00k\xac\x8c\x1d\x0e\x98\x80\xd2\xaf\xa1\xf2\x1e\xe1R1\xa2\x8e\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\xa6\xf4#+\xfa\xd7\x01\xb9j<\v\xf47\n\xa7\xd2\x8b\x11e</\xfd\x9b\xe4\x99G\xeaS\x9a\xadu(:\x94:\xaf\x06c=3>1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0x5)
mmap$auto(0x0, 0x400008, 0xdf, 0x4000000000009b72, 0x2, 0x8000)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0x2, 0x80002, 0x73)
socket(0xa, 0x801, 0x84)
r1 = getpid()
process_vm_readv$auto(r1, &(0x7f0000000000)={0x0, 0xfff}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000280)="8618c61e", 0x40000000001243}, 0xa, 0x0)
setsockopt$auto(0x3, 0x0, 0x4, 0x0, 0x28)
sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3)
sched_getattr$auto(0x0, &(0x7f0000000000)={0xcf86, 0x6, 0x6, 0x200, 0x7, 0xb, 0x6, 0xfffffffffffffff8, 0x8, 0x90}, 0x68, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0x8000000000000000, 0x15)
brk$auto(0x40008000)
r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000280)='/proc/asound/modules\x00', 0x88400, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r2, &(0x7f0000000040)=""/209, 0xd1)
socket(0x200000000000011, 0x2, 0x1)
executing program 3:
mmap$auto(0x100000000, 0x2000d, 0x1, 0xeb1, 0xffffffffffffffff, 0x100000000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty17\x00', 0x1, 0x0)
semget$auto(0x0, 0x13c, 0x1ff)
recvmmsg$auto(0xffffffffffffffff, &(0x7f00000001c0)={{0x0, 0x5, 0x0, 0x9, 0x0, 0x800000000005, 0x7ffffffd}, 0x8}, 0x3, 0x1, 0x0)
semtimedop$auto(0x0, &(0x7f0000000140)={0x7, 0x81, 0x70}, 0x1f4, 0x0)
r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r1 = openat2$auto(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)={0x982, 0x6, 0x4}, 0x7f)
r2 = syz_genetlink_get_family_id$auto_802_15_4_mac(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$auto_IEEE802154_ADD_IFACE(r1, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00012a000b000900000005002800d4000000060010006a05001d004000"/46], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x525a05df5b8ef67a)
ioctl$auto_SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0)
socket(0x1e, 0x80000, 0x9)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptye9\x00', 0x101e81, 0x0)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x2c402, 0x0)
r4 = ioctl$auto_TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, &(0x7f0000000180)=0x10)
write$auto_dev_fops_plock(r4, &(0x7f0000000200)="ea579eafbef6a78ace20c66c3ed28a307811ba5a77e0d6f20eee070874ce267321ef2da8ccef77a2a57912658cfac38b23199ba898ef2c29ea039494e108e23fc3d3de801c6cdb8c585be1ec026d327ad05a0c7812805bb6d050f902f2e77e549ec276c282a2bb8c2847f2e7105018d493a4a1dc", 0x74)
r5 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000980)='/dev/ttye9\x00', 0x102, 0x0)
rseq$auto(&(0x7f0000000300)={0xe, 0x401, 0x0, 0x6, 0xffffffff, 0x2}, 0x8000, 0x0, 0x6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x16, 0x21, 0x6, 0xfffffffffffffffe, 0x5)
sendfile$auto(r5, r3, 0x0, 0x1fff5)
close_range$auto(0x2, 0x8, 0x0)
r6 = openat$auto_nsim_dev_trap_fa_cookie_fops_dev(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/netdevsim/netdevsim6/trap_flow_action_cookie\x00', 0x4, 0x0)
io_uring_setup$auto(0x1, &(0x7f00000004c0)={0x7, 0x400, 0x3, 0x8, 0x9, 0x7, r6, [0xe, 0x80, 0x101], {0x1ff, 0x800, 0x5, 0x3, 0x4, 0x2, 0x0, 0x0, 0x9}, {0x1ead, 0x10, 0x5, 0x5, 0x5, 0x7, 0xa2f, 0x42e646f9, 0x1}})
semctl$auto_GETNCNT(0x0, 0x4, 0xe, 0x4)
io_uring_setup$auto(0x4bf15e08, 0x0)
bpf$auto(0x12, &(0x7f0000000040)=@enable_stats={0x1}, 0x26)
recvfrom$auto(0x4, 0x0, 0x101d0, 0x3ffffd, 0x0, 0x0)
unshare$auto(0x40000080)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x40000008000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda1\x00', 0x4040, 0x0)
mmap$auto(0x0, 0x400008, 0x8, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/ptp/ptp0/max_adjustment\x00', 0x168040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x2020009, 0x203, 0xeb1, 0xfffffffffffffffa, 0x8000)
unshare$auto(0x40000080)
dup2$auto(r1, 0xffffffffffffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xc18260, 0x0)
ioctl$auto(0x3, 0x800005411, 0x38)
sendmsg$auto_IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x4044000)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
socket(0x26, 0x800, 0x8)
read$auto(0x3, 0x0, 0x7fffffff)
mmap$auto(0x0, 0x2020009, 0x6, 0xeb1, 0xffffffffffffffff, 0x8000)
close_range$auto(0xffffffffffffffff, 0x8, 0x0)
sysfs$auto(0x2, 0x4000007, 0xfffffffffffffffc)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
write$auto(0xca, 0x0, 0x83)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x27ffe)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x4, 0x300000000000)
openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, 0x0, 0x208000, 0x0)
executing program 1:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x18b800, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x1000, 0x2)
mbind$auto(0x0, 0x8000000000000001, 0x6, &(0x7f00000000c0)=0xffffffff, 0x7, 0x3)
ioctl$auto_SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0)
capget$auto(0x0, 0xfffffffffffffffe)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x800, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000)
r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000440)='/proc/fs/cifs/DebugData\x00', 0x2000, 0x0)
pread64$auto(r1, &(0x7f0000000040)='/proc/scsi/sg/devices\x00', 0x10001, 0x3)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0)
prctl$auto(0x3e, 0x801, 0x0, 0x1, 0x2)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x1102, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x5, 0x8000)
executing program 3:
unshare$auto(0x40000080)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
r1 = prctl$auto_PR_SET_MM_ARG_START(0x0, 0x8, 0x0, 0xacb, 0xfffffffffffffe01)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_SW_SYNC_GET_DEADLINE(r1, 0xc0105702, &(0x7f0000000000)={0xa6fe, 0x0, <r2=>r0})
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000180), r1)
sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x100, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004983}, 0x20000040)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptya7\x00', 0x101e81, 0x0)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
io_uring_register$auto(r4, 0x9, &(0x7f00000001c0)="c36736685c38b88292237ee11f7a94d988b9b0d4ef73b9765aa881edbd0301d50b67502ee2a9243e5e2db48d15c22ced4fb53def384399f9de63bc7cc7800169e12f7f6a54982e5c3987d8f044edb7abc42eda929e496f783fb572edac35025ba22aa46ede59f3eb236a481cbc6ed26372315f7ff7b1d173ea8ac334380ada4447d2918637e5359302db30603bfb9456e50f2c67bd982c16d208d9c0de1c354135b398ea88bee6e55110e84870bbe598856e765961a13a3d7bcecfbd381ab62752edbb09ac19af7b5f27f2fed7dd1966da821d2cfd1795c4db38c890a9aa1fa1610bdade665c194218d58eae4af9357015e8", 0x3)
sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07)
read$auto(0x3, 0x0, 0x7fffffff)
executing program 3:
r0 = openat$auto_binder_features_fops_(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binderfs/features/freeze_notification\x00', 0x141000, 0x0)
pread64$auto(r0, 0x0, 0x2, 0x7a)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
executing program 3:
openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0) (async)
r0 = openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0)
write$auto(r0, &(0x7f0000000080)=',}#-#-}}\x00', 0xe6)
openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4) (async)
r1 = openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4)
ioctl$auto_RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000100)={0xfffffffd, 0x4b, 0x0, 0x8, 0xfffffff9, 0x3, 0x9, 0x1000, 0xfffffe00})
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200) (async)
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200)
clock_nanosleep$auto(0x3, 0x0, &(0x7f0000000180), &(0x7f00000001c0)={0x7, 0x75})
openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
pselect6$auto(0x7f, &(0x7f0000000240)={[0x9bb, 0x9, 0x2da3, 0x5, 0x80000001, 0x8, 0x4, 0x7f, 0x2, 0x61, 0x948, 0x6, 0x0, 0x8, 0x80, 0xffffffff]}, &(0x7f00000002c0)={[0xffffffffffffffff, 0xfffffffffffff5e9, 0x1000, 0xffff, 0xfffffffffffffffe, 0x200, 0x8000000000000000, 0x0, 0x6, 0x4, 0x2, 0x0, 0x6, 0x0, 0x17d9ec6d, 0x25b6]}, &(0x7f0000000340)={[0x4, 0xaa, 0x8, 0x4, 0x6, 0x80000000, 0x1, 0x0, 0x8, 0xfc, 0x2, 0x2, 0x1, 0x101, 0x0, 0x7]}, &(0x7f00000003c0)={0x9, 0xffffffffffffff42}, &(0x7f0000000400)="70bbc9eb0bf0c11539c987617cf2d4be5550703972db7a11cd25afacd1f687461bd4bf3452e7d76662a191301d7b003e5cbc13809abd6b56432d5e3bb66950b5d83767caf6d0003987f2784033244b4ab49ed17f17c53adb357ac4186dbe4fc53a0fd13404a9dd364c16373f4f89e051798f53780aba296d3c40fbf4499c4ef95a781498")
syz_genetlink_get_family_id$auto_nfsd(&(0x7f00000004c0), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
nanosleep$auto(&(0x7f0000000500)={0x8, 0x3}, &(0x7f0000000540)={0x10001, 0x5})
mq_timedsend$auto(r2, &(0x7f0000000580)='nfsd\x00', 0x4, 0x9, &(0x7f00000005c0)={0x9d, 0x10000})
io_pgetevents$auto(0xb, 0x7, 0x8, &(0x7f0000000600)={0x3, 0xfffffffffffffff9, 0x7, 0x9}, &(0x7f0000000640)={0x1, 0x41}, &(0x7f00000006c0)={&(0x7f0000000680)={0x6}})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_XFS_IOC_ALLOCSP64(r1, 0x40305824, &(0x7f0000000740)={0x1c3, 0x1, 0x1, 0x4, 0xd, <r4=>0x0})
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async)
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000880), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'nr0\x00', <r6=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'veth0_to_batadv\x00', <r7=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000940)={'ip6tnl0\x00', <r8=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00', <r9=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00', <r10=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000a40)={'team0\x00', <r12=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00', <r13=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ac0)={'pim6reg0\x00', <r14=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000b00)={'ipvlan1\x00', <r15=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00', <r16=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00', <r17=>0x0})
sendmsg$auto_ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000e80)={&(0x7f0000000840), 0xc, &(0x7f0000000e40)={&(0x7f0000000bc0)={0x244, r5, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_FEATURES_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @ETHTOOL_A_FEATURES_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfff}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xf9d}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3f5cc39}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}, @ETHTOOL_A_FEATURES_HEADER={0xa0, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7ff}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x841}, 0x4000)
executing program 4:
r0 = openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000006900)='/sys/kernel/config/target/dbroot\x00', 0x189002, 0x0)
write$auto(r0, &(0x7f0000000100)='/dev/audio1\x00', 0x100000a3d7) (async)
r1 = mq_open$auto(&(0x7f0000000000)='\'\x00', 0x1, 0x8, &(0x7f0000000040)={0x5, 0xff, 0x80, 0x1})
io_submit$auto(0x8, 0x5, &(0x7f00000000c0)=&(0x7f0000000080)={0x6100000, 0x7, 0xc, 0x0, 0x9, r0, 0xffffffffffffff00, 0xfffffffffffffb13, 0x4, 0x0, 0x4, r1})
executing program 3:
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x3)
mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read$auto_rng_chrdev_ops_core(0xffffffffffffffff, &(0x7f0000000040)=""/4096, 0xfffffe82)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0xc8600, 0x0)
getdents$auto(0xffffffffffffffff, 0x0, 0x400018)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_CONNECT(r0, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x8880)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
executing program 4:
r0 = socket(0xa, 0x80003, 0x3a)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
r1 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_OVS_FLOW_CMD_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdc02, {}, [@OVS_FLOW_ATTR_PROBE={0x4}, @OVS_FLOW_ATTR_KEY={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xf, 0x0, 0x1, [@generic="99cb9d0ac5e7ca3d"]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040071}, 0x800)
r3 = setfsuid$auto(0xee00)
r4 = setfsuid$auto(0xee01)
setresuid$auto(r3, r4, r3)
r5 = setfsuid$auto(0xee00)
r6 = setfsuid$auto(0xee01)
setresuid$auto(r5, r6, r5)
r7 = getpid()
process_vm_readv$auto(r7, &(0x7f0000000100)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xf}, 0x6, 0x0)
sendmsg$auto_OVS_FLOW_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001380)={&(0x7f0000000040)={0x1320, r1, 0x4, 0x70bd2c, 0x10000, {}, [@OVS_FLOW_ATTR_MASK={0x12fe, 0x7, 0x0, 0x1, [@typed={0x14, 0x3, 0x0, 0x0, @ipv6=@loopback}, @generic="c30fd0c4f7597fbfb0395890c0bc9741a0af52d26458c9fa9584426c5c5a5a0bf0a4aeb8185d1c4ec803949f5da3d3f5ec37c1144169df1312bf11f928e3f955e65e7c1df1dbe18dd602320e4bd1b2636ddefef6a4ef0e01f7b4ec9ba409b419fcda6a76d02d56d5211100409932ec6c23d7fe823b3fd9a73e56c2bdbe6b0c9de91794349ff4f592b6a66916c6e8463fcde18f195e1b677234d8dca114ad56f53978648df5505d30260365d3edcca96749e87cc7fb7702030b2d0a9e906b07a22da839f1", @generic="d68df5687673c9f7015038865f1e65da7b087cd198617491ee3b595b65cca24c40f7e28afc45b5ebc9d4bfa432b7f2f562865ee5e973886bfe3bdf20ec4ceefcd4c0c2ec7d62e64e545fe6e810712ebf963e4038", @typed={0x8, 0x6d, 0x0, 0x0, @fd=r0}, @generic="5741e1a026549d8bc5d2fd54cc5e4a4eeaec664c2c15fd6b6acd4bc09c6ba77439885bb2b7f24fb594c407fbc157116664fd", @nested={0x1004, 0xe1, 0x0, 0x1, [@generic="fdc2ac8797fd5123fb8f054a89f2a6053181f6d17b5d173169fa3ddad5f3d657523615d068a17f890ff94fe2875c4e3ddb3a62740ed7631f81a5ca800c02fbd9e77ac612d5274297e0f54bc72818543ea539da64e161c8de7e04254c77d7456c5ed9d3d7fdaff775b61300fbe7abb09a5056f08a782617c3dd2c1dae24155379e4b5a92043e52b7e40afb890ac5fbb6b8f1036e31b916b99f255d1b28d895208e1797e216d7567873e870e6872c84b630378318614e3d6727f39988a3d6150b7fa961f78dce67e8e4cef3f666526e4770ef47b6caed08ad1379af68fc2b7df94b5d9bcceb862875da3010893c343a322350a4c1dfe4b6a837be9a835547540535117cdfea59da934381947df85a55b7541591c069288a200db14ed229851f53aa58f24c9c76794d945aa641cede8b3e8517a190f264e00fca600d431705e5f814b270c14d87cb561162594d98103b6e8758c837b2cd102ad0db123a29c492a547f3f6cc7d00539c760b944fef4b62e072a1d45e075e6c78ca95507f58e9e521ab1163e36ca4507a6dd3b47842058ee2f1af962ff157c5e900c35ff15c1d362203f7ddcdf4b657ae761edcdd3b699b65da671e586c39b1da178c871623effbdb3d976412987651b5dd19d9e730646de22505c0ab0661740daf419928ca75c096e7353aa663683902f03ef8cecf24915c47d296128ccf441a74af0ef05678306909f97f09b725e315293ec1867cb92b57843c74dbfa8b1d070fe46e723b3d39a055873b15ee832aef79d67d9bf20ed1d5484f37910301393aad6b1143168ae841f8fc5b4a16ad905f24b5c9599386c1fb692b28b090dbae26a512cb0a4b0b4d7b4aa21131b797ef5fd3d13fbac94434e5bd57510e725e737a2c29d941af2cb0e813d40eeae81f570d685f9388f52dcdb2d54138a4d0e2d65884ba7bb53861c32d6a9e10c382658143e8557fd282d1511075a19e1be411443f8ec863a44abfc0615377949e335bb11d3b478c4590eee9a0e0aca01ba4f9f28f989ef4cc38959bfc3d7f97c4e969296818aada93eeb62c8997faa37c5f8a11d8284d5a21a754451f63efb4acf9d347b802f585862cdb2e60909d11d057e49d0b18c2c7756c91c4ab00e623f2aa627401d5f3eac4c4a984ba8fad3e05f2e7304e69194f69c77ff82d32d41c23272b77137abde44d8750cd0b929dce3b2edd55c81dcf491e90e79c071cd60b030a7b6ee1a83990c36490b2a190ec728a5a31b7ed1112a3694fd8a7df3eafa3fd74fbac17d4c26ba8102a6b45ffc574f15fd82f116d7592ba8edb15d2754602863c9c48f7baee0813d563d04a8622d5d390a290521f0a8f99a71586a9046c6e1b2c37adba3b230852ffada0330337c5abecafc47bb29bb6e52f760084c244800cbff56450534d1736d1b7789dabd3af891caf422a2b78ac26b114e8307165c8a832b72897e6f51a959b42ca2f76824810e6bbbd5f349a0bb96628b66c0804bfaa56a9aa6a24e2a9f7d9ca83e9a0c1913a641e6023536f1cb54a95307bffca43a16e2bea208d51e80e8e58cc4fffc8f6a8f26b45fbc279be3ab5b7b9c6f511a7855101f28f06df45b5d7cc4f103391b2059e27827ed616bbcc009e310838cbf2511d852121b38ebea56821ade02e7640a6febe264972e6158223087c54424b0f8b9ee02743c736cf364140c67f0d9df6a351dab2ee0a85f8431f12ef1afca7549d6b7ff264235ec548eddc0b3400557ad069afa1c9e40464b78fa095b4170212adbb33ad2cdb4614ac02fd38e5d60af960ff964df91acf024f9894e4d33bcc9721fe9df33a8fab4b2f0812355dd21f81acb976e6a7505aa965555bb42d971b207b7ca7c8e896c0ef9ca85fd9a708a82054a44929330929aee29d75c6b16948867a938d7688ce2e030b6b771ed8769336a32b8ff4127dd7739f62d368303fb475f07c3a1358e1480feb15e4284a6416f1ff69ee1d0b41ce44a257ac67500667945c6812295862b0db70658548c0a576c1f5384dc39a4b02e87615604ee0c44aa967d265d1a0f767239cd2e0041ef200863e68e4b835130055601ddd47e35518a1011ec0cc6b279b495cd3d1c470076f31bedf235d1386d6b8052185ab49e3a442ffdc05b7769c4fbc84d1fae685898c036275da551aa26e00a38728dfae2be88125fd388e08e712d2d7b378ef7b06119027c48ef012450f44f2448ecb39ca403abde4673111da68bd9912f58ec7555cb70d2b41137b845db61f12b8d4abfb98b4d04a18a97c70105080aa0603629508d1a329e5b7a1f16a44c42053a7904e3f4b695a5417db17887d0ee23cf2eec277d55cac398957e2ed017613dc50305f13b148a9045841edfbc62e7cdb9618119791f87ad8357cb78f762615a601488af9183021227e50ec330176dee1a04ea9bae39bd31851942ab591e9548cb709209985d7305b73bf1458c62d3c6cfd8b75071e3f28913f9271d36749fb14e9fd4bf9b05f3400551092457c2036df75d9c0345b41bdf25f2a5ca1d1df8d5e5f28d089179252ad2e1c41619441e45d97dd4c228be300a026988edf65f1eaa283dc126aaf0ba7c6f323610a5822ce5fc2cb9f4520a45d863115264f103d49a8b995d9780a7240c87deec19909c91c4b9ebab6e4f9a4669801c44b825ff9158ee94f3f2c3ac0311d20374d4c995cd655a179bfcfebf4e0410b7835b0fdd25a965a8a09e2f341f475222018d289a9c5fd7368d87f686591d247516b9cde5394339cff50a8122585f150f3aaca8ae19d247e87dbc1ac43b02534ec386fd2744a3711eff31fbb6fd5e66142dc2aa0b7dd8cd71b101298ffc55d56b58d690b2dd993bd03e30963764151f992535d53ccdf43d58f640dfef8ad079aa0138abb818085b03a14699c2da78fa34691804ea4cf916d413956b770870ae2312ca6d1b22f3c30fcf5ed33aaa3cd0b4e33c83c39c3bf229b3b54198e3f04da79fa291f89b879a9b67fe244fcaa150ccd64e2c3f238202e3311dcea805c95d3105cc23c80e1ebf9ca93381af6ecf490f8e72e5a136204f9ef50df540f5f312f6546824eedeba19f7bc9ea8dc06c2152d5d0e34a00c7e95dbfe6c0f01e9317e0a68ddef1ac52aa996ef19d5fa27e3b5ec761cc2d7869a7962208224b3c1b3d93526def8eab3534c4bcc7172af697d8004c74a56eb4a13d25e457c87c67995f4e542fdda0b4942dbd362ed16b42041daf44a1438777f96fabdeab74f1de4e86ceb121c9736962e08c60888c4e101b1b5876e325018a6330c459f4f7f57f460913ce0c23699331769a8deacf2df7cbfaca0699f2d40e2f1cb7a604042c5c4be36f8d119b12274eadac6e84fba35d8e94157cbf764946593e4369eadb23f2fef94f697f36b251409758fecc397f4d3d8ab22481f11420de89c935fd1f1b2b97038d2fd84d2044b5f5d11c4a0feb0bd64254806faeb50d3dae6d3ec0ea8edb56ad368914f12083a9818f2737f14330e70106b23f87980df7f1554053fb31c64a800faa49c1b532f742e6d55e32f28c493b74e0af074c6500e6be748ca31c1b37a340360d6277c95b0bb73fc75b1a60dcbb8f6736b98766a2078695a58736fd144b6f1ae17fa72bab965f0c76bdaa87dfaf8a697bacab009de168582224dffe455ff790e6b5a94bc18510c779b057cb55a74bfff8aceb47100881baa083cef35522b0476f9510ad91ec109abf678a7dae3585b2da6557e17b243d107c83e44065293438f77b07c9dc096857c386f8db72924fd0e9bddb81f2bdd8925583aa06582fcbdecb53b3335d1f76bf2320c9cee8a241b0f80486f3f3d8811c60638e1a00a0cc5ea97f286d76d754ed1105d738f0537aab6be8f358b3c7c4a1042281afd6ca2163747c1879e9e1bbe8887ee22ebadb78e6c893d52747f13237a4b24241bd6890bb62ede528069052786f0a73883c9a79211957634fb2b8bbadf0c769bd88cd520d362865da014b768822f539a5386312c0d70ee800c341c8672eb1e9b5b562f1e8590a47d045529e2f7f5d2b77c6459c6c36457a4a88f779789fe617f12aa40b7bcd99617f64dd4eb08c0bc5c300f467519ae71d1a0d4dbacc1fb145c8f47cf6a78c4dcecac1f784c59cbaa40f5bcda0176df9057afaa0536d4fc8f63ee486505c0453510cf88d4bc361737b65f1122665d19f51e25004c57ab35f8d05a2582f634c0a3bc5a1a047160803b11cae161d8bc4e2c5719bca313fb844f8c6323fbce9d22e3a43e01cc690da736fbf2a88eea35498ace6f3a327b907a39a8922480b4123f8e89b1d191d8c478fbe189401f9005a17eb12d673cf2352ede5ca2573239e2249db0cd131efe39f43f840be8f7f9194ce265dcb568bda7364bb8425380d5c928c41ef53aa1716aa113e22f12a5390ffa56f58c6f3d71ad29b68631b067ba9debe1ec546403730c3ba56f4acba0b323544f01386fb62e447b308ea1e600f48d13202b8a06c4a3179ca3915788ee66244375e6cac2a5fa6ea6ca8e95f535e86cd0744d6f01b67cd2da7945be620865908ef9a71158a47ec572076d098b169860ae24cf3ce70af74d23ddd3b4b280b09c8a3fba6f9eeb0b3a9ec542645e25f14f6ccbca18b041204b6b1207b58820096a7bda02cf1c8bf1c147479b7eef667ba0717cbfa066a525ad9c162832b7408f355aaecdc739e358defd599bec95060a28f828561fa2b50e0293a26d61d901e9f7715a29ed495e2e40610e3cf0aefe2f41dad38004f874f04496583765f9e1ed5f077a389e095e1cbc8ec62fb9b91e5b67ed4cd65e9297c36154613a50d843794f1420dd17e01ee28082d67dfb20eb7315a9b2f015efd7395e98168315d2130d657c942d60a68c378f3537ffe886a674f7c9c1793bf4a59df0405d47f2efbcf94dc4741cdde698407b34598cefff1ac43e27a6f0f4e544ac3f81ce377c4f003047d17fc5a41893ccf262806d1b831df9747977ebdae7ea45d6e4debafe3e5f9bd1e0c37b741ee7161ddacf00501b8ee14f9f8baa8ba4d9c109f9fea7ada055c395958fa2c0ecbe515ba66d714db5ad7550d91708e8cbab43d91a0f247d4e6dc25954504213c3b6b193521f05915da79e0bdb16992bbab36cd5775d01e57f983478cba942bb3773046a7e3eeb5ce6aef42ced902c0a30e12394b8704f70d94924fde69e793e9b84cdf240b103918211259dedc5edf135df57d7bf07e266f31a04bff80f8fa57dac7f6faa5058d796a7dd36299a8a680218f6d9a31867128dc0b66e4dbe4de8796552c6a6c78ef85aa959e42eb0c980e05aa47b20a3a4578fb23d198e28de5fab14882870106f1e7c448e4368fd0acb68bcaa6895f3d7f50aea413ce96042ae80e258eca17374af3326cc6b462d337c2b9ab9f197208d6358801e7048469d0230229e3310660732c439b571b965cc89cbe30b74387a2124ce654a008f9486a6d4d6e5e29e5c7382a240bd2f241e68f255e3021ca659d58db2671219e6dee6b6b6ab74b31d13dbf04bfa38a6f58b49a9605c21a081a771a29c76e34fdbbb5866ed88c020ee535ce576e3711c253dbd1cf3aa876094ad13dd926c0997f716b2374f6420b9e5fcf79065225bdf937813871a6ef116c7e2b652b98307e4b1613993c71ed5859fd2d22030e927a3bb241ddf803dc7a727e117673bd3f86d040bc8aa9fc3da27519d9fc54303c8e7cc7e3dce37e472203ef32542328aa90ad8955db158a04be0a094dc5e9c7ee10afe639c36541dd29949e966636b2c7390e0620b1a146b15ed4b230f8d7e1dbf4516393b8346dc6220"]}, @typed={0x21, 0xcd, 0x0, 0x0, @binary="97d66ef5a595a441c8dac4777b6e6e9019adcac1585bb1e23e119ef3a0"}, @nested={0x28, 0x5e, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @uid=r3}, @typed={0x14, 0xc6, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @typed={0x8, 0xaa, 0x0, 0x0, @uid=r6}]}, @nested={0x132, 0x12b, 0x0, 0x1, [@nested={0x4, 0xdf}, @nested={0x4, 0x2f}, @generic="bc4b4d5122093fc8589a83ffb70b87a3df35ce3adda27b048ee4bd6c3f626d6c0120f1099c6c78c53fba6cb52a4b2da7a09d9d65f7400aafed1d07b935f59fba718d75e58277ecc08418447a63430abdb2559a584a4411735275d99c5d70b2d5228de1cafb6adbe7701b3cc0b80f83697d826beef2b8a32f71", @nested={0x4, 0x15b}, @typed={0x8, 0x67, 0x0, 0x0, @pid=r7}, @generic="2811b97ae107f64ff90affe4c07eb3de778da1afd546a709b97e13c0b16c5ff4526a35b55e79b76844e9ae845a45858abe1d9eb735d626f5c09f465ea0a5908afb61373cd2fa7ee48b6b3a2a2c2ce895fd5e497dd7795380863c5b0e12572004f2837cec92a295ca72729e1a9cf03865031e0f5cab5f098dc2467275fb2f762ef11acac495074e5eb4cbd6b1945e71bee9df3744c74b3cda17b981784ef624c291"]}, @nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0xcc}, @typed={0x8, 0xe3, 0x0, 0x0, @ipv4=@multicast2}]}]}, @OVS_FLOW_ATTR_UFID_FLAGS={0x8, 0xa, 0x2}, @OVS_FLOW_ATTR_PROBE={0x4}]}, 0x1320}}, 0x0)
executing program 3:
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000000)=ANY=[@ANYRESOCT], 0x44}}, 0x4044000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00'})
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0xf3, 0xb0, @raw=0xfffff038}})
write$auto(0xffffffffffffffff, 0x0, 0xa)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r2, &(0x7f0000000140)={{0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x200002, 0x8}, 0x801}, 0xfffffff9, 0x10, 0x0)
ioctl$auto(r2, 0x8946, 0x24)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r3 = openat2$auto(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x5, 0x4b, 0x4}, 0x8)
mmap$auto(0x0, 0xaaf, 0x4000000000df, 0x40000000000eb1, r3, 0x8000)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x70007fc)
write$auto(r0, 0x0, 0x6)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/ifb0/flags\x00', 0xb02, 0x0)
r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card2/id\x00', 0x200, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r5, &(0x7f0000001280)=""/23, 0xfdfc)
sendfile$auto(r4, r4, 0x0, 0x3)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x2000000, 0x0, 0x10}, 0x4000084)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)
executing program 1:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
write$auto(r0, &(0x7f0000000000)='/dev/loop6\x00', 0x6)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x18dd01, 0x0)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 30, 30, 14, 27, 27, 26, 29, 30, 14, 4, 40, 4, 19, 15, 26, 30, 3, 13, 11]
detailed listing:
executing program 0:
r0 = fsopen$auto(0x0, 0x1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r2, 0x711, 0x70b52c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848)
r3 = socket(0xa, 0x801, 0x84)
r4 = socket(0xa, 0x1, 0x0)
setsockopt$auto(r4, 0x29, 0x37, &(0x7f0000000080)='\x15!\xa8^J/\xddCx4!\x00\xd3\x8f\x1e\x1b\xc3 \xe2\xa8\xd6\xd9\xc0\xa2\x0f\x88\xb1e\x8a\xd8?\xfe\xda\xc4\xef\xff(i\xc6@\x91[\vBj\x0eQ\xce\x16\'C\x8cYA\x92u\xd5\xb8\\\x82,\xe2=y\x9bR\xbcn\xa0c\x16~\x86\"t\xde\x14\xe4\xa5\xfe\xb5', 0x110)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x9c)
fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0)
openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/block/loop6/rqos/wbt/id\x00', 0x101a00, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2000a, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x5, 0x400a)
process_vm_writev$auto(0x0, &(0x7f00000011c0)={&(0x7f00000001c0)="42777dd1330b458d0b5c44ca32e94fc00cfbce962ee7d8f31c0f90c327830f55adfdceafcc0f7b5a21ea23bdf5344d47d49d60218e57bb33118d04fdd37f5fd17f96", 0x8}, 0x7, 0x0, 0x7, 0xb5)
sendmsg$auto_TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000094}, 0x8080)
r5 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, 0x0)
sendmmsg$auto(r5, &(0x7f00000006c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200)="4c0300000000000000a3677337f9eca9075f6bba441b", 0x49}, 0x5, 0x0, 0x5, 0x1}, 0x5}, 0x2, 0x100)
r6 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0)
ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r6, 0x80085502, &(0x7f0000000140)=ANY=[@ANYBLOB="1000006e061e0ec3b417bee1e649c8b817d7a922cb9526d474f20699f1ab6bd6953f82874c6cd0230cb5bf"])
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/ptp/ptp0/n_vclocks\x00', 0x8502, 0x0)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
openat$auto_ext4_dir_operations_ext4(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/bluetooth/hci4/power\x00', 0x20100, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0xfffffffd, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x4000000000007, 0xa505}, 0x800}, 0x4, 0x4008)
executing program 0:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 0:
openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x30db80, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000240)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7fffffff, 0x10)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x1, 0xeb1, 0xfffffffffffffffa, 0x2)
openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000002840)='/sys/kernel/tracing/trace_clock\x00', 0x8000, 0x0)
fchmodat2$auto(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x61ed, 0x4)
r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x60800, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000840)={{@raw=0x8, 0x7, 0xba28, 0x0, "708c58271a7985a7704331f78af8d149fc53d81fd4a7553c2ff48b48a8a57689adcc1ca6d2cbfa93b50590c9", @raw=0x6}, 0x0, @bytes=@data_ptr=0x0, "fa491e08108961dd5708680f1134935851612a52d629535f54f3832490fc4e7f79daef312b3df3307044713a4801d409aefe3f932f78fc311771094e769c0095f94ee6d74f2517f34a0bbbf502bf3392ac4d93bde5f733ba936c0890312cf035bc44117db9b683eedc5e02a703fc82750d8d6ebac0c3019ef8e6c1eecea33a59"})
setsockopt$auto(0xffffffffffffffff, 0x11, 0x66, 0x0, 0x8)
setrlimit$auto(0x5, &(0x7f0000000000)={0x3, 0x4})
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r2)
unshare$auto(0x40000080)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop4\x00', 0x14be02, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r3, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
mlock$auto(0x7c88, 0x7fff)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0x3000000, 0x0, 0x40000000001, 0x0, 0x5}}, 0x100003, 0x9)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/maps\x00', 0x0, 0x0)
pread64$auto(r4, 0x0, 0xeda5, 0xc86)
close_range$auto(0x2, 0x8, 0x3)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto_KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)={0x7, 0x0, [{0x40000001, 0x2, 0x1}]})
getcpu$auto(&(0x7f00000000c0)=0xa51e, &(0x7f0000000140)=0x4800000, &(0x7f0000000180)={[0x5035, 0x2, 0x1, 0x4, 0x9, 0x8001, 0x9, 0x6, 0x9, 0x6, 0x0, 0x1, 0x2, 0x7, 0x4, 0xffffffff]})
socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
executing program 0:
ioctl$auto_NS_GET_TGID_IN_PIDNS(0xffffffffffffffff, 0x8004b709, 0x0)
bpf$auto_BPF_LINK_GET_NEXT_ID(0x1f, &(0x7f00000002c0)=@enable_stats={0x7f}, 0xa6)
sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, 0x0, 0x20008800)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1a/sun\x00', 0x0, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x3, 0x6)
lsm_list_modules$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x401c5820, 0x0)
mkdir$auto(0x0, 0x353)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x5, 0x73)
socket(0xa, 0x1, 0x84)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x13)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/rcutree/parameters/rcu_resched_ns\x00', 0x20000, 0x0)
read$auto(r1, 0x0, 0x20)
socket(0x2, 0x801, 0x106)
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x4000000008000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmsg$auto_MACSEC_CMD_ADD_RXSA(0xffffffffffffffff, 0x0, 0x4008884)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x400000003)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x14, r3, 0x1, 0x70bd31, 0x25dfdbfc}, 0x14}}, 0x24048004)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
r4 = socket(0x2, 0xa, 0x1)
openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ubifs/chk_orphans\x00', 0x426a2, 0x0)
bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_4={0x1f, r4, 0x10000}, 0x10)
executing program 0:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 32:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x3, 0x9)
io_uring_setup$auto(0x1, 0x0) (async)
io_uring_setup$auto(0x1, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
timer_create$auto(0x9, 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa}) (async)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa})
socket(0x2c, 0x3, 0x0) (async)
r2 = socket(0x2c, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'dummy0\x00', <r4=>0x0})
bind$auto(r2, &(0x7f0000000100)=@xdp={0x2c, 0xc, r4, 0x1e}, 0x6b)
sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x200400b0)
r5 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), r0)
sendmsg$auto_NFC_CMD_STOP_POLL(r3, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x40, r5, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x9}, @NFC_ATTR_DEVICE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x1d, 0x14, '/proc/sys/dev/cdrom/info\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x24008001)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x6, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0)
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 3:
unshare$auto(0x40000080)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
r1 = prctl$auto_PR_SET_MM_ARG_START(0x0, 0x8, 0x0, 0xacb, 0xfffffffffffffe01)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_SW_SYNC_GET_DEADLINE(r1, 0xc0105702, &(0x7f0000000000)={0xa6fe, 0x0, <r2=>r0})
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000180), r1)
sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x100, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004983}, 0x20000040)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptya7\x00', 0x101e81, 0x0)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0)
write$auto(0x3, 0x0, 0x7fffffff)
io_uring_register$auto(r4, 0x9, &(0x7f00000001c0)="c36736685c38b88292237ee11f7a94d988b9b0d4ef73b9765aa881edbd0301d50b67502ee2a9243e5e2db48d15c22ced4fb53def384399f9de63bc7cc7800169e12f7f6a54982e5c3987d8f044edb7abc42eda929e496f783fb572edac35025ba22aa46ede59f3eb236a481cbc6ed26372315f7ff7b1d173ea8ac334380ada4447d2918637e5359302db30603bfb9456e50f2c67bd982c16d208d9c0de1c354135b398ea88bee6e55110e84870bbe598856e765961a13a3d7bcecfbd381ab62752edbb09ac19af7b5f27f2fed7dd1966da821d2cfd1795c4db38c890a9aa1fa1610bdade665c194218d58eae4af9357015e8", 0x3)
sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07)
read$auto(0x3, 0x0, 0x7fffffff)
executing program 3:
r0 = openat$auto_binder_features_fops_(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binderfs/features/freeze_notification\x00', 0x141000, 0x0)
pread64$auto(r0, 0x0, 0x2, 0x7a)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async)
openat$auto_tomoyo_self_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
executing program 3:
openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0) (async)
r0 = openat$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/netdev:wlan0/stations/08:02:11:00:00:01/rc_stats\x00', 0x1c0860847fa6048a, 0x0)
write$auto(r0, &(0x7f0000000080)=',}#-#-}}\x00', 0xe6)
openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4) (async)
r1 = openat$auto(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4)
ioctl$auto_RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000100)={0xfffffffd, 0x4b, 0x0, 0x8, 0xfffffff9, 0x3, 0x9, 0x1000, 0xfffffe00})
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200) (async)
setsockopt$auto(r0, 0x6, 0x5, &(0x7f0000000140)='].!\\*%\x00', 0x200)
clock_nanosleep$auto(0x3, 0x0, &(0x7f0000000180), &(0x7f00000001c0)={0x7, 0x75})
openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
pselect6$auto(0x7f, &(0x7f0000000240)={[0x9bb, 0x9, 0x2da3, 0x5, 0x80000001, 0x8, 0x4, 0x7f, 0x2, 0x61, 0x948, 0x6, 0x0, 0x8, 0x80, 0xffffffff]}, &(0x7f00000002c0)={[0xffffffffffffffff, 0xfffffffffffff5e9, 0x1000, 0xffff, 0xfffffffffffffffe, 0x200, 0x8000000000000000, 0x0, 0x6, 0x4, 0x2, 0x0, 0x6, 0x0, 0x17d9ec6d, 0x25b6]}, &(0x7f0000000340)={[0x4, 0xaa, 0x8, 0x4, 0x6, 0x80000000, 0x1, 0x0, 0x8, 0xfc, 0x2, 0x2, 0x1, 0x101, 0x0, 0x7]}, &(0x7f00000003c0)={0x9, 0xffffffffffffff42}, &(0x7f0000000400)="70bbc9eb0bf0c11539c987617cf2d4be5550703972db7a11cd25afacd1f687461bd4bf3452e7d76662a191301d7b003e5cbc13809abd6b56432d5e3bb66950b5d83767caf6d0003987f2784033244b4ab49ed17f17c53adb357ac4186dbe4fc53a0fd13404a9dd364c16373f4f89e051798f53780aba296d3c40fbf4499c4ef95a781498")
syz_genetlink_get_family_id$auto_nfsd(&(0x7f00000004c0), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
nanosleep$auto(&(0x7f0000000500)={0x8, 0x3}, &(0x7f0000000540)={0x10001, 0x5})
mq_timedsend$auto(r2, &(0x7f0000000580)='nfsd\x00', 0x4, 0x9, &(0x7f00000005c0)={0x9d, 0x10000})
io_pgetevents$auto(0xb, 0x7, 0x8, &(0x7f0000000600)={0x3, 0xfffffffffffffff9, 0x7, 0x9}, &(0x7f0000000640)={0x1, 0x41}, &(0x7f00000006c0)={&(0x7f0000000680)={0x6}})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto_XFS_IOC_ALLOCSP64(r1, 0x40305824, &(0x7f0000000740)={0x1c3, 0x1, 0x1, 0x4, 0xd, <r4=>0x0})
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async)
sendmsg$auto_NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x40, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, 0x8001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x6}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000880), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'nr0\x00', <r6=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'veth0_to_batadv\x00', <r7=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000940)={'ip6tnl0\x00', <r8=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'macsec0\x00', <r9=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'dummy0\x00', <r10=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'veth1_virt_wifi\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000a40)={'team0\x00', <r12=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a80)={'tunl0\x00', <r13=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ac0)={'pim6reg0\x00', <r14=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000b00)={'ipvlan1\x00', <r15=>0x0})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'macvtap0\x00', <r16=>0x0})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000b80)={'rose0\x00', <r17=>0x0})
sendmsg$auto_ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000e80)={&(0x7f0000000840), 0xc, &(0x7f0000000e40)={&(0x7f0000000bc0)={0x244, r5, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_FEATURES_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @ETHTOOL_A_FEATURES_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfff}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xf9d}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3f5cc39}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}, @ETHTOOL_A_FEATURES_HEADER={0xa0, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7ff}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x841}, 0x4000)
executing program 4:
r0 = openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000006900)='/sys/kernel/config/target/dbroot\x00', 0x189002, 0x0)
write$auto(r0, &(0x7f0000000100)='/dev/audio1\x00', 0x100000a3d7) (async)
r1 = mq_open$auto(&(0x7f0000000000)='\'\x00', 0x1, 0x8, &(0x7f0000000040)={0x5, 0xff, 0x80, 0x1})
io_submit$auto(0x8, 0x5, &(0x7f00000000c0)=&(0x7f0000000080)={0x6100000, 0x7, 0xc, 0x0, 0x9, r0, 0xffffffffffffff00, 0xfffffffffffffb13, 0x4, 0x0, 0x4, r1})
executing program 3:
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x3)
mmap$auto(0x0, 0x202000a, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read$auto_rng_chrdev_ops_core(0xffffffffffffffff, &(0x7f0000000040)=""/4096, 0xfffffe82)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0xc8600, 0x0)
getdents$auto(0xffffffffffffffff, 0x0, 0x400018)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff)
sendmsg$auto_NBD_CMD_CONNECT(r0, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x8880)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
executing program 4:
r0 = socket(0xa, 0x80003, 0x3a)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
setsockopt$auto(0x400000000000003, 0x29, 0xd4, 0x0, 0x4)
r1 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_OVS_FLOW_CMD_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdc02, {}, [@OVS_FLOW_ATTR_PROBE={0x4}, @OVS_FLOW_ATTR_KEY={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xf, 0x0, 0x1, [@generic="99cb9d0ac5e7ca3d"]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040071}, 0x800)
r3 = setfsuid$auto(0xee00)
r4 = setfsuid$auto(0xee01)
setresuid$auto(r3, r4, r3)
r5 = setfsuid$auto(0xee00)
r6 = setfsuid$auto(0xee01)
setresuid$auto(r5, r6, r5)
r7 = getpid()
process_vm_readv$auto(r7, &(0x7f0000000100)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={0x0, 0xf}, 0x6, 0x0)
sendmsg$auto_OVS_FLOW_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001380)={&(0x7f0000000040)={0x1320, r1, 0x4, 0x70bd2c, 0x10000, {}, [@OVS_FLOW_ATTR_MASK={0x12fe, 0x7, 0x0, 0x1, [@typed={0x14, 0x3, 0x0, 0x0, @ipv6=@loopback}, @generic="c30fd0c4f7597fbfb0395890c0bc9741a0af52d26458c9fa9584426c5c5a5a0bf0a4aeb8185d1c4ec803949f5da3d3f5ec37c1144169df1312bf11f928e3f955e65e7c1df1dbe18dd602320e4bd1b2636ddefef6a4ef0e01f7b4ec9ba409b419fcda6a76d02d56d5211100409932ec6c23d7fe823b3fd9a73e56c2bdbe6b0c9de91794349ff4f592b6a66916c6e8463fcde18f195e1b677234d8dca114ad56f53978648df5505d30260365d3edcca96749e87cc7fb7702030b2d0a9e906b07a22da839f1", @generic="d68df5687673c9f7015038865f1e65da7b087cd198617491ee3b595b65cca24c40f7e28afc45b5ebc9d4bfa432b7f2f562865ee5e973886bfe3bdf20ec4ceefcd4c0c2ec7d62e64e545fe6e810712ebf963e4038", @typed={0x8, 0x6d, 0x0, 0x0, @fd=r0}, @generic="5741e1a026549d8bc5d2fd54cc5e4a4eeaec664c2c15fd6b6acd4bc09c6ba77439885bb2b7f24fb594c407fbc157116664fd", @nested={0x1004, 0xe1, 0x0, 0x1, [@generic="fdc2ac8797fd5123fb8f054a89f2a6053181f6d17b5d173169fa3ddad5f3d657523615d068a17f890ff94fe2875c4e3ddb3a62740ed7631f81a5ca800c02fbd9e77ac612d5274297e0f54bc72818543ea539da64e161c8de7e04254c77d7456c5ed9d3d7fdaff775b61300fbe7abb09a5056f08a782617c3dd2c1dae24155379e4b5a92043e52b7e40afb890ac5fbb6b8f1036e31b916b99f255d1b28d895208e1797e216d7567873e870e6872c84b630378318614e3d6727f39988a3d6150b7fa961f78dce67e8e4cef3f666526e4770ef47b6caed08ad1379af68fc2b7df94b5d9bcceb862875da3010893c343a322350a4c1dfe4b6a837be9a835547540535117cdfea59da934381947df85a55b7541591c069288a200db14ed229851f53aa58f24c9c76794d945aa641cede8b3e8517a190f264e00fca600d431705e5f814b270c14d87cb561162594d98103b6e8758c837b2cd102ad0db123a29c492a547f3f6cc7d00539c760b944fef4b62e072a1d45e075e6c78ca95507f58e9e521ab1163e36ca4507a6dd3b47842058ee2f1af962ff157c5e900c35ff15c1d362203f7ddcdf4b657ae761edcdd3b699b65da671e586c39b1da178c871623effbdb3d976412987651b5dd19d9e730646de22505c0ab0661740daf419928ca75c096e7353aa663683902f03ef8cecf24915c47d296128ccf441a74af0ef05678306909f97f09b725e315293ec1867cb92b57843c74dbfa8b1d070fe46e723b3d39a055873b15ee832aef79d67d9bf20ed1d5484f37910301393aad6b1143168ae841f8fc5b4a16ad905f24b5c9599386c1fb692b28b090dbae26a512cb0a4b0b4d7b4aa21131b797ef5fd3d13fbac94434e5bd57510e725e737a2c29d941af2cb0e813d40eeae81f570d685f9388f52dcdb2d54138a4d0e2d65884ba7bb53861c32d6a9e10c382658143e8557fd282d1511075a19e1be411443f8ec863a44abfc0615377949e335bb11d3b478c4590eee9a0e0aca01ba4f9f28f989ef4cc38959bfc3d7f97c4e969296818aada93eeb62c8997faa37c5f8a11d8284d5a21a754451f63efb4acf9d347b802f585862cdb2e60909d11d057e49d0b18c2c7756c91c4ab00e623f2aa627401d5f3eac4c4a984ba8fad3e05f2e7304e69194f69c77ff82d32d41c23272b77137abde44d8750cd0b929dce3b2edd55c81dcf491e90e79c071cd60b030a7b6ee1a83990c36490b2a190ec728a5a31b7ed1112a3694fd8a7df3eafa3fd74fbac17d4c26ba8102a6b45ffc574f15fd82f116d7592ba8edb15d2754602863c9c48f7baee0813d563d04a8622d5d390a290521f0a8f99a71586a9046c6e1b2c37adba3b230852ffada0330337c5abecafc47bb29bb6e52f760084c244800cbff56450534d1736d1b7789dabd3af891caf422a2b78ac26b114e8307165c8a832b72897e6f51a959b42ca2f76824810e6bbbd5f349a0bb96628b66c0804bfaa56a9aa6a24e2a9f7d9ca83e9a0c1913a641e6023536f1cb54a95307bffca43a16e2bea208d51e80e8e58cc4fffc8f6a8f26b45fbc279be3ab5b7b9c6f511a7855101f28f06df45b5d7cc4f103391b2059e27827ed616bbcc009e310838cbf2511d852121b38ebea56821ade02e7640a6febe264972e6158223087c54424b0f8b9ee02743c736cf364140c67f0d9df6a351dab2ee0a85f8431f12ef1afca7549d6b7ff264235ec548eddc0b3400557ad069afa1c9e40464b78fa095b4170212adbb33ad2cdb4614ac02fd38e5d60af960ff964df91acf024f9894e4d33bcc9721fe9df33a8fab4b2f0812355dd21f81acb976e6a7505aa965555bb42d971b207b7ca7c8e896c0ef9ca85fd9a708a82054a44929330929aee29d75c6b16948867a938d7688ce2e030b6b771ed8769336a32b8ff4127dd7739f62d368303fb475f07c3a1358e1480feb15e4284a6416f1ff69ee1d0b41ce44a257ac67500667945c6812295862b0db70658548c0a576c1f5384dc39a4b02e87615604ee0c44aa967d265d1a0f767239cd2e0041ef200863e68e4b835130055601ddd47e35518a1011ec0cc6b279b495cd3d1c470076f31bedf235d1386d6b8052185ab49e3a442ffdc05b7769c4fbc84d1fae685898c036275da551aa26e00a38728dfae2be88125fd388e08e712d2d7b378ef7b06119027c48ef012450f44f2448ecb39ca403abde4673111da68bd9912f58ec7555cb70d2b41137b845db61f12b8d4abfb98b4d04a18a97c70105080aa0603629508d1a329e5b7a1f16a44c42053a7904e3f4b695a5417db17887d0ee23cf2eec277d55cac398957e2ed017613dc50305f13b148a9045841edfbc62e7cdb9618119791f87ad8357cb78f762615a601488af9183021227e50ec330176dee1a04ea9bae39bd31851942ab591e9548cb709209985d7305b73bf1458c62d3c6cfd8b75071e3f28913f9271d36749fb14e9fd4bf9b05f3400551092457c2036df75d9c0345b41bdf25f2a5ca1d1df8d5e5f28d089179252ad2e1c41619441e45d97dd4c228be300a026988edf65f1eaa283dc126aaf0ba7c6f323610a5822ce5fc2cb9f4520a45d863115264f103d49a8b995d9780a7240c87deec19909c91c4b9ebab6e4f9a4669801c44b825ff9158ee94f3f2c3ac0311d20374d4c995cd655a179bfcfebf4e0410b7835b0fdd25a965a8a09e2f341f475222018d289a9c5fd7368d87f686591d247516b9cde5394339cff50a8122585f150f3aaca8ae19d247e87dbc1ac43b02534ec386fd2744a3711eff31fbb6fd5e66142dc2aa0b7dd8cd71b101298ffc55d56b58d690b2dd993bd03e30963764151f992535d53ccdf43d58f640dfef8ad079aa0138abb818085b03a14699c2da78fa34691804ea4cf916d413956b770870ae2312ca6d1b22f3c30fcf5ed33aaa3cd0b4e33c83c39c3bf229b3b54198e3f04da79fa291f89b879a9b67fe244fcaa150ccd64e2c3f238202e3311dcea805c95d3105cc23c80e1ebf9ca93381af6ecf490f8e72e5a136204f9ef50df540f5f312f6546824eedeba19f7bc9ea8dc06c2152d5d0e34a00c7e95dbfe6c0f01e9317e0a68ddef1ac52aa996ef19d5fa27e3b5ec761cc2d7869a7962208224b3c1b3d93526def8eab3534c4bcc7172af697d8004c74a56eb4a13d25e457c87c67995f4e542fdda0b4942dbd362ed16b42041daf44a1438777f96fabdeab74f1de4e86ceb121c9736962e08c60888c4e101b1b5876e325018a6330c459f4f7f57f460913ce0c23699331769a8deacf2df7cbfaca0699f2d40e2f1cb7a604042c5c4be36f8d119b12274eadac6e84fba35d8e94157cbf764946593e4369eadb23f2fef94f697f36b251409758fecc397f4d3d8ab22481f11420de89c935fd1f1b2b97038d2fd84d2044b5f5d11c4a0feb0bd64254806faeb50d3dae6d3ec0ea8edb56ad368914f12083a9818f2737f14330e70106b23f87980df7f1554053fb31c64a800faa49c1b532f742e6d55e32f28c493b74e0af074c6500e6be748ca31c1b37a340360d6277c95b0bb73fc75b1a60dcbb8f6736b98766a2078695a58736fd144b6f1ae17fa72bab965f0c76bdaa87dfaf8a697bacab009de168582224dffe455ff790e6b5a94bc18510c779b057cb55a74bfff8aceb47100881baa083cef35522b0476f9510ad91ec109abf678a7dae3585b2da6557e17b243d107c83e44065293438f77b07c9dc096857c386f8db72924fd0e9bddb81f2bdd8925583aa06582fcbdecb53b3335d1f76bf2320c9cee8a241b0f80486f3f3d8811c60638e1a00a0cc5ea97f286d76d754ed1105d738f0537aab6be8f358b3c7c4a1042281afd6ca2163747c1879e9e1bbe8887ee22ebadb78e6c893d52747f13237a4b24241bd6890bb62ede528069052786f0a73883c9a79211957634fb2b8bbadf0c769bd88cd520d362865da014b768822f539a5386312c0d70ee800c341c8672eb1e9b5b562f1e8590a47d045529e2f7f5d2b77c6459c6c36457a4a88f779789fe617f12aa40b7bcd99617f64dd4eb08c0bc5c300f467519ae71d1a0d4dbacc1fb145c8f47cf6a78c4dcecac1f784c59cbaa40f5bcda0176df9057afaa0536d4fc8f63ee486505c0453510cf88d4bc361737b65f1122665d19f51e25004c57ab35f8d05a2582f634c0a3bc5a1a047160803b11cae161d8bc4e2c5719bca313fb844f8c6323fbce9d22e3a43e01cc690da736fbf2a88eea35498ace6f3a327b907a39a8922480b4123f8e89b1d191d8c478fbe189401f9005a17eb12d673cf2352ede5ca2573239e2249db0cd131efe39f43f840be8f7f9194ce265dcb568bda7364bb8425380d5c928c41ef53aa1716aa113e22f12a5390ffa56f58c6f3d71ad29b68631b067ba9debe1ec546403730c3ba56f4acba0b323544f01386fb62e447b308ea1e600f48d13202b8a06c4a3179ca3915788ee66244375e6cac2a5fa6ea6ca8e95f535e86cd0744d6f01b67cd2da7945be620865908ef9a71158a47ec572076d098b169860ae24cf3ce70af74d23ddd3b4b280b09c8a3fba6f9eeb0b3a9ec542645e25f14f6ccbca18b041204b6b1207b58820096a7bda02cf1c8bf1c147479b7eef667ba0717cbfa066a525ad9c162832b7408f355aaecdc739e358defd599bec95060a28f828561fa2b50e0293a26d61d901e9f7715a29ed495e2e40610e3cf0aefe2f41dad38004f874f04496583765f9e1ed5f077a389e095e1cbc8ec62fb9b91e5b67ed4cd65e9297c36154613a50d843794f1420dd17e01ee28082d67dfb20eb7315a9b2f015efd7395e98168315d2130d657c942d60a68c378f3537ffe886a674f7c9c1793bf4a59df0405d47f2efbcf94dc4741cdde698407b34598cefff1ac43e27a6f0f4e544ac3f81ce377c4f003047d17fc5a41893ccf262806d1b831df9747977ebdae7ea45d6e4debafe3e5f9bd1e0c37b741ee7161ddacf00501b8ee14f9f8baa8ba4d9c109f9fea7ada055c395958fa2c0ecbe515ba66d714db5ad7550d91708e8cbab43d91a0f247d4e6dc25954504213c3b6b193521f05915da79e0bdb16992bbab36cd5775d01e57f983478cba942bb3773046a7e3eeb5ce6aef42ced902c0a30e12394b8704f70d94924fde69e793e9b84cdf240b103918211259dedc5edf135df57d7bf07e266f31a04bff80f8fa57dac7f6faa5058d796a7dd36299a8a680218f6d9a31867128dc0b66e4dbe4de8796552c6a6c78ef85aa959e42eb0c980e05aa47b20a3a4578fb23d198e28de5fab14882870106f1e7c448e4368fd0acb68bcaa6895f3d7f50aea413ce96042ae80e258eca17374af3326cc6b462d337c2b9ab9f197208d6358801e7048469d0230229e3310660732c439b571b965cc89cbe30b74387a2124ce654a008f9486a6d4d6e5e29e5c7382a240bd2f241e68f255e3021ca659d58db2671219e6dee6b6b6ab74b31d13dbf04bfa38a6f58b49a9605c21a081a771a29c76e34fdbbb5866ed88c020ee535ce576e3711c253dbd1cf3aa876094ad13dd926c0997f716b2374f6420b9e5fcf79065225bdf937813871a6ef116c7e2b652b98307e4b1613993c71ed5859fd2d22030e927a3bb241ddf803dc7a727e117673bd3f86d040bc8aa9fc3da27519d9fc54303c8e7cc7e3dce37e472203ef32542328aa90ad8955db158a04be0a094dc5e9c7ee10afe639c36541dd29949e966636b2c7390e0620b1a146b15ed4b230f8d7e1dbf4516393b8346dc6220"]}, @typed={0x21, 0xcd, 0x0, 0x0, @binary="97d66ef5a595a441c8dac4777b6e6e9019adcac1585bb1e23e119ef3a0"}, @nested={0x28, 0x5e, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @uid=r3}, @typed={0x14, 0xc6, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @typed={0x8, 0xaa, 0x0, 0x0, @uid=r6}]}, @nested={0x132, 0x12b, 0x0, 0x1, [@nested={0x4, 0xdf}, @nested={0x4, 0x2f}, @generic="bc4b4d5122093fc8589a83ffb70b87a3df35ce3adda27b048ee4bd6c3f626d6c0120f1099c6c78c53fba6cb52a4b2da7a09d9d65f7400aafed1d07b935f59fba718d75e58277ecc08418447a63430abdb2559a584a4411735275d99c5d70b2d5228de1cafb6adbe7701b3cc0b80f83697d826beef2b8a32f71", @nested={0x4, 0x15b}, @typed={0x8, 0x67, 0x0, 0x0, @pid=r7}, @generic="2811b97ae107f64ff90affe4c07eb3de778da1afd546a709b97e13c0b16c5ff4526a35b55e79b76844e9ae845a45858abe1d9eb735d626f5c09f465ea0a5908afb61373cd2fa7ee48b6b3a2a2c2ce895fd5e497dd7795380863c5b0e12572004f2837cec92a295ca72729e1a9cf03865031e0f5cab5f098dc2467275fb2f762ef11acac495074e5eb4cbd6b1945e71bee9df3744c74b3cda17b981784ef624c291"]}, @nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0xcc}, @typed={0x8, 0xe3, 0x0, 0x0, @ipv4=@multicast2}]}]}, @OVS_FLOW_ATTR_UFID_FLAGS={0x8, 0xa, 0x2}, @OVS_FLOW_ATTR_PROBE={0x4}]}, 0x1320}}, 0x0)
executing program 3:
sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000000)=ANY=[@ANYRESOCT], 0x44}}, 0x4044000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macsec0\x00'})
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0xf3, 0xb0, @raw=0xfffff038}})
write$auto(0xffffffffffffffff, 0x0, 0xa)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x2000000}, 0x4)
sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000)
recvmmsg$auto(r2, &(0x7f0000000140)={{0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x200002, 0x8}, 0x801}, 0xfffffff9, 0x10, 0x0)
ioctl$auto(r2, 0x8946, 0x24)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r3 = openat2$auto(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x5, 0x4b, 0x4}, 0x8)
mmap$auto(0x0, 0xaaf, 0x4000000000df, 0x40000000000eb1, r3, 0x8000)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x70007fc)
write$auto(r0, 0x0, 0x6)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/ifb0/flags\x00', 0xb02, 0x0)
r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card2/id\x00', 0x200, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r5, &(0x7f0000001280)=""/23, 0xfdfc)
sendfile$auto(r4, r4, 0x0, 0x3)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_GET_INTERFACE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r1, 0xb01, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x2000000, 0x0, 0x10}, 0x4000084)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)
executing program 1:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
r0 = socket(0x2, 0x5, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
write$auto(r0, &(0x7f0000000000)='/dev/loop6\x00', 0x6)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x18dd01, 0x0)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 30, 30, 14, 27, 27, 26, 29, 30, 13]
detailed listing:
executing program 0:
r0 = fsopen$auto(0x0, 0x1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r2, 0x711, 0x70b52c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848)
r3 = socket(0xa, 0x801, 0x84)
r4 = socket(0xa, 0x1, 0x0)
setsockopt$auto(r4, 0x29, 0x37, &(0x7f0000000080)='\x15!\xa8^J/\xddCx4!\x00\xd3\x8f\x1e\x1b\xc3 \xe2\xa8\xd6\xd9\xc0\xa2\x0f\x88\xb1e\x8a\xd8?\xfe\xda\xc4\xef\xff(i\xc6@\x91[\vBj\x0eQ\xce\x16\'C\x8cYA\x92u\xd5\xb8\\\x82,\xe2=y\x9bR\xbcn\xa0c\x16~\x86\"t\xde\x14\xe4\xa5\xfe\xb5', 0x110)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(r3, 0x10000000084, 0x9, 0x0, 0x9c)
fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0)
openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/block/loop6/rqos/wbt/id\x00', 0x101a00, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2000a, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x5, 0x400a)
process_vm_writev$auto(0x0, &(0x7f00000011c0)={&(0x7f00000001c0)="42777dd1330b458d0b5c44ca32e94fc00cfbce962ee7d8f31c0f90c327830f55adfdceafcc0f7b5a21ea23bdf5344d47d49d60218e57bb33118d04fdd37f5fd17f96", 0x8}, 0x7, 0x0, 0x7, 0xb5)
sendmsg$auto_TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000094}, 0x8080)
r5 = socket(0x11, 0x3, 0x9)
capset$auto(0x0, 0x0)
sendmmsg$auto(r5, &(0x7f00000006c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200)="4c0300000000000000a3677337f9eca9075f6bba441b", 0x49}, 0x5, 0x0, 0x5, 0x1}, 0x5}, 0x2, 0x100)
r6 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0)
ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r6, 0x80085502, &(0x7f0000000140)=ANY=[@ANYBLOB="1000006e061e0ec3b417bee1e649c8b817d7a922cb9526d474f20699f1ab6bd6953f82874c6cd0230cb5bf"])
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/ptp/ptp0/n_vclocks\x00', 0x8502, 0x0)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
openat$auto_ext4_dir_operations_ext4(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/bluetooth/hci4/power\x00', 0x20100, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0xfffffffd, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x4000000000007, 0xa505}, 0x800}, 0x4, 0x4008)
executing program 0:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 0:
openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x30db80, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000240)={{0x0, 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7fffffff, 0x10)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x2020009, 0x1, 0xeb1, 0xfffffffffffffffa, 0x2)
openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000002840)='/sys/kernel/tracing/trace_clock\x00', 0x8000, 0x0)
fchmodat2$auto(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x61ed, 0x4)
r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x60800, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000840)={{@raw=0x8, 0x7, 0xba28, 0x0, "708c58271a7985a7704331f78af8d149fc53d81fd4a7553c2ff48b48a8a57689adcc1ca6d2cbfa93b50590c9", @raw=0x6}, 0x0, @bytes=@data_ptr=0x0, "fa491e08108961dd5708680f1134935851612a52d629535f54f3832490fc4e7f79daef312b3df3307044713a4801d409aefe3f932f78fc311771094e769c0095f94ee6d74f2517f34a0bbbf502bf3392ac4d93bde5f733ba936c0890312cf035bc44117db9b683eedc5e02a703fc82750d8d6ebac0c3019ef8e6c1eecea33a59"})
setsockopt$auto(0xffffffffffffffff, 0x11, 0x66, 0x0, 0x8)
setrlimit$auto(0x5, &(0x7f0000000000)={0x3, 0x4})
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r2)
unshare$auto(0x40000080)
r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop4\x00', 0x14be02, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r3, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
mlock$auto(0x7c88, 0x7fff)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0x3000000, 0x0, 0x40000000001, 0x0, 0x5}}, 0x100003, 0x9)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
r4 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/maps\x00', 0x0, 0x0)
pread64$auto(r4, 0x0, 0xeda5, 0xc86)
close_range$auto(0x2, 0x8, 0x3)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
write$auto(0x3, 0x0, 0xfffffdef)
ioctl$auto_KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)={0x7, 0x0, [{0x40000001, 0x2, 0x1}]})
getcpu$auto(&(0x7f00000000c0)=0xa51e, &(0x7f0000000140)=0x4800000, &(0x7f0000000180)={[0x5035, 0x2, 0x1, 0x4, 0x9, 0x8001, 0x9, 0x6, 0x9, 0x6, 0x0, 0x1, 0x2, 0x7, 0x4, 0xffffffff]})
socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
executing program 0:
ioctl$auto_NS_GET_TGID_IN_PIDNS(0xffffffffffffffff, 0x8004b709, 0x0)
bpf$auto_BPF_LINK_GET_NEXT_ID(0x1f, &(0x7f00000002c0)=@enable_stats={0x7f}, 0xa6)
sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, 0x0, 0x20008800)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1a/sun\x00', 0x0, 0x0)
openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x3, 0x6)
lsm_list_modules$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x401c5820, 0x0)
mkdir$auto(0x0, 0x353)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x5, 0x73)
socket(0xa, 0x1, 0x84)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x13)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/rcutree/parameters/rcu_resched_ns\x00', 0x20000, 0x0)
read$auto(r1, 0x0, 0x20)
socket(0x2, 0x801, 0x106)
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x4000000008000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0)
sendmsg$auto_MACSEC_CMD_ADD_RXSA(0xffffffffffffffff, 0x0, 0x4008884)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x400000003)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x14, r3, 0x1, 0x70bd31, 0x25dfdbfc}, 0x14}}, 0x24048004)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
r4 = socket(0x2, 0xa, 0x1)
openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ubifs/chk_orphans\x00', 0x426a2, 0x0)
bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_4={0x1f, r4, 0x10000}, 0x10)
executing program 0:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 32:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x3, 0x9)
io_uring_setup$auto(0x1, 0x0) (async)
io_uring_setup$auto(0x1, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
timer_create$auto(0x9, 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa}) (async)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa})
socket(0x2c, 0x3, 0x0) (async)
r2 = socket(0x2c, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'dummy0\x00', <r4=>0x0})
bind$auto(r2, &(0x7f0000000100)=@xdp={0x2c, 0xc, r4, 0x1e}, 0x6b)
sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x200400b0)
r5 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), r0)
sendmsg$auto_NFC_CMD_STOP_POLL(r3, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x40, r5, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x9}, @NFC_ATTR_DEVICE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x1d, 0x14, '/proc/sys/dev/cdrom/info\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x24008001)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x6, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0)
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 27, 26, 29, 30, 13]
detailed listing:
executing program 0:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 32:
mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
process_vm_readv$auto(0x0, &(0x7f0000000140)={&(0x7f0000000080)="e9fdbea1442542376cebb5dc66b731ced35bdb1f06adc43903ba986f303bd92f2022e112a1783fcc1d65275d08eb54983ce1ef65e32921db1d03f2389782437b75b13f5a5a476be07c1254daf0ca41f3007b55fd62e8605a3e2a5f3bb7640a20ee723443db"}, 0x8, &(0x7f0000000400)={&(0x7f0000000380)="7c62bf750222a7bd300e3267a49c48cef855cb1a24808d37d7482eef0a2d5350f81492c1b7e178d92a235476695c6576c65dd22e4b7ab1c79c2791f3d21aad46a50afcea237e20a27a6a43ce1348c1cac09b98d2fcef949381f4", 0x2}, 0xc8, 0x0)
ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000)
r0 = socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x80000000, 0x7, 0x6, 0xfffffffffffffffe, 0x9, 0x3, 0x4000006, 0x4, 0xb2, 0x8000, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0xaa0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x3, 0x0, 0x9, 0x0, 0x0, 0x400000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x202, 0xd)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0)
acct$auto(0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r2, 0x0, 0x100000a3d9)
mmap$auto(0xf0, 0x400009, 0xdf, 0x9b72, r1, 0x8000)
socket(0xa, 0x5, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x109802, 0x0)
close_range$auto(0x2, r3, 0x0)
r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r4)
ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x400000b5, 0x2, 0x6}]})
openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/tracing/options/annotate\x00', 0x4000, 0x0)
msync$auto(0x7, 0x8, 0x400000004)
open(0x0, 0x163340, 0x2c)
io_uring_setup$auto(0x59, &(0x7f0000000000)={0x83, 0x1000, 0x6, 0x1, 0xffffffff, 0xa, 0xffffffffffffffff, [], {0x8, 0x1, 0x0, 0x8998d60, 0x8000100, 0x7fff, 0x8000105, 0x0, 0xffffffffffffffff}, {0xbfc7, 0x1, 0x52, 0x8, 0x47302, 0x3d, 0x8, 0x7, 0x8001}})
executing program 2:
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) (async)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x3, 0x9)
io_uring_setup$auto(0x1, 0x0) (async)
io_uring_setup$auto(0x1, 0x0)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
timer_create$auto(0x9, 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa}) (async)
waitid$auto_P_PID(0x1, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000340)={{0x1c00000000000000, 0xc}, {0xfffffffffffffff7, 0x7ff}, 0x4, 0x2, 0x4, 0x100000000, 0xffffffffffffffff, 0x100000001, 0x4fcd, 0x2, 0xfffffffffffffbff, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffa})
socket(0x2c, 0x3, 0x0) (async)
r2 = socket(0x2c, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'dummy0\x00', <r4=>0x0})
bind$auto(r2, &(0x7f0000000100)=@xdp={0x2c, 0xc, r4, 0x1e}, 0x6b)
sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x200400b0)
r5 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), r0)
sendmsg$auto_NFC_CMD_STOP_POLL(r3, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x40, r5, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x9}, @NFC_ATTR_DEVICE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x1d, 0x14, '/proc/sys/dev/cdrom/info\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x24008001)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x6, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0)
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 30, 13]
detailed listing:
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 13]
detailed listing:
executing program 2:
r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x48980, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x3, 0x1000, 0x1, 0x1, 0x2}, "654c6dbc7a4d30983899a7e1325b6a29ba1e184410ba9f74e82a3fa6c3ccf1bf"})
ioctl$auto_SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000140)={0x1, 0x3, "9f35e80f65bf2106f286ecb4e41345a4f8b5ba0ed21e33fbe7d9441c59ad860111249c401a12495546774f18f6503db646e3ef16a926c5304a41de33fdf44d63", "42629de39c5e4a487062ffeacc166c9f2ac2679016600521e571f7f32eaa12330c98ad5471377b273aa505b46ab2e5cd3b34ac1e15d71a6ea95b488b011f64b2bd92088a00", 0x3ff, 0x71c, "a981b013ff76722191f572f75a96919ba94ed0d5b055136e00f2b25a7d5c888673087cd2a906f0a5083757ebf3232affa950c6360936420798f452d387bcc6ee"})
socket(0xa, 0x3, 0x3b)
connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socket(0x22, 0x3, 0x0)
recvmmsg$auto(0x3, 0x0, 0xfffc, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1\x00', 0x107501, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0xdbb3b890005640c6, 0x0)
write$auto(r1, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou$W&^kjO\tK\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\b\x00\x00\x00\x00\x00\x00\x00I\xcb\x16f\xc0\x8e|8x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5FD\x15f\x90\xa2\x84', 0x16051)
readv$auto(0x3, 0x0, 0x1)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xa0e42, 0x0)
write$auto(r2, &(0x7f0000000000)='//\xf2\x00', 0x80000000)
mmap$auto(0x8, 0x810002, 0x8, 0x8000000008011, 0x3, 0x2)
mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv6/conf/batadv_slave_0/mldv1_unsolicited_report_interval\x00', 0x2, 0x0)
readv$auto(0x3, 0x0, 0x1)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000200), 0x101802, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x301040, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x2080, 0x0)
ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 13]
detailed listing:
executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
r6 = prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r7 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r7, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r8 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r8, 0xaf01, 0x5)
ioctl$auto_VHOST_NET_SET_BACKEND(r6, 0x4008af30, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
r7 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$auto_VHOST_SET_OWNER(r7, 0xaf01, 0x5)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
mmap$auto(0xfffffffffffffffd, 0x400008, 0xfffffffffffffff2, 0x9b74, 0xffffffffffffffff, 0x8002)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x13}}, 0x54)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x6, @rand_addr=0x64010100}, 0x7)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x9, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
lgetxattr$auto(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='\xda--\x00', 0x0, 0x100)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
r6 = socket(0xa, 0x3, 0x3b)
getsockopt$auto(r6, 0x29, 0x30, 0x0, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
socket(0xa, 0x3, 0x3b)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
uname$auto(0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
pwrite64$auto(r1, &(0x7f0000000140)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00,\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t,\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/242, 0xfdf0, 0x8000000000000003)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
prctl$auto(0x2, 0x1, 0x0, 0x1, 0x2)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = socket(0x2, 0x1, 0x106)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r2, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r3, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r4 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r4, 0x0, 0x0)
write$auto(r4, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=<r5=>0x0)
connect$auto(r1, &(0x7f0000000080)=@nfc={0x27, r5, 0xffffffffffffffff, 0x6}, 0x803)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r2, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r3 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r3, 0x0, 0x0)
write$auto(r3, &(0x7f0000000100)='\x00', 0x5)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0))
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r2, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r3 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r3, 0x0, 0x0)
write$auto(r3, &(0x7f0000000100)='\x00', 0x5)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r2, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
r3 = openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
read$auto_proc_auxv_operations_base(r3, 0x0, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r2, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_proc_auxv_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/auxv\x00', 0x80, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r2, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7)
write$auto(0xffffffffffffffff, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/module/parameters/sig_enforce\x00', 0x1, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r1, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
socket(0x2, 0x1, 0x106)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r1, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r1, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000140)=""/103, 0x67)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r1, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/fs/cifs/smbd_max_fragmented_recv_size\x00', 0x40800, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 13]
detailed listing:
executing program 0:
mmap$auto(0x169, 0x20009, 0x4, 0x12, 0x401, 0x40000000000004)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 13]
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 4:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})
socket(0x27, 0xa, 0x5)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
minimized 29 calls -> 2 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 12]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r2 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r2, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r3 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r3, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)
ioctl$auto_VHOST_SET_VRING_ADDR2(r1, 0x4028af11, &(0x7f0000000040)={0x0, 0x2, 0x5ae9, 0xffffffffffffffff, 0x80, 0x4})

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r1 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r1, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)
write$auto_sg_fops_sg(r2, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 10]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r1 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r1, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) (async)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 9]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r1 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r1, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r1 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r1, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/039/001\x00', 0x300382, 0x0) (async)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
r1 = socket(0x2, 0x802, 0x1)
setsockopt$auto_SO_WIFI_STATUS(r1, 0x0, 0x11, 0x0, 0x8000) (async)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 7]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
socket(0x2, 0x802, 0x1)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 6]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) (async)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
close_range$auto(0x0, 0x5, 0x0) (async, rerun: 32)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 4]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
mmap$auto(0x0, 0x2020009, 0x4000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
r0 = ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
process_madvise$auto_MADV_NORMAL(r0, &(0x7f0000000300)={&(0x7f0000000200)="ccd633f622b16d141dc5234f74f81b7281bace881aaa0629ce09b0619ffbb177104c9a332a9f55867ae1b00d07b0590066d4733a9abda686df377d2a6427b7c6b18b681a250daa27018bc50b1c1bbb36a8d171e015eefbc04b32ded80583b09499f3200dbf14020ab289c8356531e6a401ba7ddf1af6e417cbda2986446a0d229e58a94346e66fb4a2cd8cff513250672ef4a42ef75fb49359d47089f27fd924ee3eefa0569750bba292a3dac569ed7b5334a6aaad80ecda7da16917d79446e28216f97ea2c5a0a05be5", 0x2}, 0x0, 0x0, 0x7)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
ioctl$auto_TUNSETSNDBUF2(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x7fff)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 1]
detailed listing:
executing program 1:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
executing program 0:
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
minimized 13 calls -> 1 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)

program did not crash
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program did not crash
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
write$auto(0xffffffffffffffff, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program did not crash
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program did not crash
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, 0x0, 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program did not crash
testing program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, 0x0, 0xc0482, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m20.36932111s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
simplifying C reproducer
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing compiled C program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
testing program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
validation run: crashed=true
testing program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
validation run: crashed=true
testing program (duration=1m20.36932111s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-write$auto-openat$auto_sg_fops_sg
detailed listing:
executing program 0:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/sg/parameters/scatter_elem_sz\x00', 0x22001, 0x0)
write$auto(r0, &(0x7f0000000200)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xabxo\xd9\x90\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xa5\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5Y\a\xc1\xe9(\x85R\x96\xe4\x86\\\x13\xa9\x1a&\x19\x8a9\x82\xf0\x83\f\xf7\xeb\x00\x00\x00\x00\x00\x00\x00\x00v\x92<e\x8b?#a\xa3 \xaa\x19\xde}\x10\xa4\x95\x02\x12\xbb\x13\xeb<\xc8x\x86\xc6\x12w2u\xe5\xb0\x8f\xda\x88R\xf4 @\xdc\x8e\xaa\xf0{\xa8,\xa3\xc7\x01\\\x03(\xc0\xb3\xf3\xf80eqo\x1a\xe0\xc6\xd9\xcf\xab\xf4_\xf2\xedY\xff\xe0\xbe\x82cX_&o\xc4S\x87\x9a\'w\x18\x91]\xcf\x179?Ag%\v\x12\x86\xf0\xe2d\xdc\xaa\x0f\xa8v\xc3\x83\x89\xbe\x1c^\r\xfb\xdb\x14\x8cC\xe9>\xfc\xf3\x1a/\x99dcA\xf4B\xf3\xba\x17\xea', 0xe)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0xc0482, 0x0)

program crashed: UBSAN: shift-out-of-bounds in sg_build_indirect
validation run: crashed=true
reproducing took 1h56m29.261396649s
repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1898:13
shift exponent 64 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1898
 sg_build_reserve+0xc8/0x180 drivers/scsi/sg.c:2008
 sg_add_sfp drivers/scsi/sg.c:2190 [inline]
 sg_open+0xd5c/0x1aa0 drivers/scsi/sg.c:349
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4677 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4836
 do_file_open+0x20e/0x430 fs/namei.c:4865
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabff99c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfaefbef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fabffc15fa0 RCX: 00007fabff99c819
RDX: 00000000000c0482 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007fabffa32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabffc15fac R14: 00007fabffc15fa0 R15: 00007fabffc15fa0
 </TASK>
---[ end trace ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/scsi/sg.c:1898:13
shift exponent 64 is too large for 32-bit type 'int'
CPU: 0 UID: 0 PID: 6017 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494
 sg_build_indirect.cold+0x1b/0x20 drivers/scsi/sg.c:1898
 sg_build_reserve+0xc8/0x180 drivers/scsi/sg.c:2008
 sg_add_sfp drivers/scsi/sg.c:2190 [inline]
 sg_open+0xd5c/0x1aa0 drivers/scsi/sg.c:349
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4677 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4836
 do_file_open+0x20e/0x430 fs/namei.c:4865
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabff99c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfaefbef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fabffc15fa0 RCX: 00007fabff99c819
RDX: 00000000000c0482 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007fabffa32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabffc15fac R14: 00007fabffc15fa0 R15: 00007fabffc15fa0
 </TASK>
---[ end trace ]---