Extracting prog: 4m10.796867542s Minimizing prog: 1h25m41.773103931s Simplifying prog options: 6m36.486686481s Extracting C: 2m26.645686815s Simplifying C: 0s extracting reproducer from 25 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io-syz_usb_control_io$rtl8150-setxattr$incfs_metadata-openat$dir-fcntl$notify detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x8e) fcntl$notify(r5, 0x402, 0x80000002) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5, 10, 14, 16, 4, 3, 2, 12, 19, 3, 34, 3, 4, 3, 4, 24, 26, 5, 2, 9, 14, 4, 18, 24] detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x50, r0, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339162471f4005500"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40840}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100fdffffbffe000800e0000002000000000000000700000000ffffffff000000000000000000000000000307954e230020020000003c020000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000004d66c00000000000000000000000000ffffac141418040000000000000009000000000000000600000000000000ffff0000000000001c25080000000000010000000000000083000000000000000000000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000002000000fcffffff000000002cbd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0xe599, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffa}, {0xfffffffffffffffc, 0x6}, 0x1, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x41}, 0x4d5, 0x2b}, 0x2, @in=@remote, 0x0, 0x0, 0x3, 0x3, 0x2bee3cc6, 0x400000}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7000000}, 0x1c) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000180)={0x2c, &(0x7f0000000c00)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdir(0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000100)={0x14, &(0x7f0000000040)={0x40, 0x24, 0x5d, {0x5d, 0x2, "b29c08e57e55c15d3515e8f9a632261a62e237a9cd9a420651418b2d2739869932e2b369e122c2462ddaa9648d2964153fb738db11e3e83abf516a71d35c7dffe970e31539d8065d8f82e879c78b6c520fe3c6c1b0b774b5a02fab"}}, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000240)={0x1c, &(0x7f0000000140)={0x40, 0xc, 0x14, "0a07041b8875dfe9adbfd4dd6c94ee48732bde0a"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0xa3}}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) executing program 0: mkdir(&(0x7f0000000000)='./sys\x00', 0x3d2) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x21f5, &(0x7f0000000040)={0x0, 0x4a09, 0x20, 0x3, 0x190}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) r1 = syz_ublk_setup_io_uring(0x22, &(0x7f0000000340)={0x0, 0x4cfa, 0x0, 0x0, 0x85}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_PIPE={0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, {0x0, 0x0, 0x7}}) r5 = syz_open_dev$swradio(&(0x7f0000000100), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r5, 0xc0405665, &(0x7f0000000080)={0x1, 0x4, 0xffff, 0xdff2f6991cc06f9f, 0x0, 0x64c, 0xa}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10, 0x604}}}, 0x0) r6 = syz_ublk_setup_io_uring(0x4302, &(0x7f0000000500)={0x0, 0xb0b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) syz_ublk_add_dev(r0, r2, r8, 0x0, &(0x7f0000000280)={0x2e, 0x78, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x100000001, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@any_dev={0x4, 0x3b0, 0x0, 0x0, 0x1000, 0x3, r10, 0x0, 0x6}}}, &(0x7f0000000340)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/module/acpi/parameters/trace_state\x00', 0x1, 0x0) write(r11, &(0x7f0000000a00)='e', 0x1) executing program 0: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write$proc_mixer(r0, &(0x7f0000000080)=ANY=[], 0x1001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x469}) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/tty/ttyS1/console\x00', 0x2, 0x49) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x4b6, 0xfffffffffffffffe, 0x58}}, 0x30) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x62001, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa7) add_key$fscrypt_v1(&(0x7f00000002c0), &(0x7f0000000300)={'fscrypt:', @desc4}, &(0x7f0000000440)={0x0, "8527d2100090af54bfbca283be11c0de7af30e90937920fcba13d90af61beaa44d66a6535daf1bc35fb3af1e9197e31d26589d073c10184095fb00", 0x14}, 0x48, 0xffffffffffffffff) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000001100)={0x0, @bt={0x500, 0x2d0, 0x1, 0x280000, 0xdd9f83, 0x1, 0x9, 0x1d, 0x2, 0x4, 0x721, 0x13, 0x6, 0x7f, 0x37, 0x4, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) syz_clone3(&(0x7f00000007c0)={0xa0000000, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x800, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x7}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000940)=ANY=[@ANYBLOB="400100001a000100feffffff00010000ac1e0101000000100000000000000000fc010000000000000000000000000001000107174e2300050a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc010000000000000000000000000001fe000000000000009201000000000010a39b000000000800ffff0000000000001c250800000000000500000000000000fcffffffffffffff0400000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffefffffff9030000000000007e00000005350000020001002000000000000000480003006465666c617465"], 0x140}}, 0x844) executing program 1: r0 = socket(0x2, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='wg0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000000680)=[{{&(0x7f0000000180)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000280)="0bffeb36a5589800d082488a3574213ca10df06c0190bd39c9b1deec10a83bbf50c82aaac0533629c96719d6", 0x2c}], 0x1}}], 0x1, 0x4) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x13, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000040000000000000a20000000000a01040000000000000000020000000900010073797a30000000004c000000120a01040000000000000000020000000900010073797a30000000000900020073797a300000000008000300000000031800048009000100736e6d70000000000500030011"], 0x94}}, 0x0) executing program 1: mkdir(&(0x7f0000000040)='my_sys\x00', 0xd6) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_inet_SIOCSIFADDR(r2, 0x890d, 0x0) setsockopt$MRT_DONE(r1, 0x0, 0xc9, 0x0, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(r0, 0xc00c6f3e, &(0x7f0000000080)={0x7, 0x0, r1}) mmap$IORING_OFF_SQ_RING(0x0, 0x5, 0x0, 0x1010, r3, 0x0) syz_clone(0x836a691, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000100)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r4, 0x80047210, &(0x7f0000000000)) executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000200), 0xa0201, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) inotify_init1(0x80800) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000300000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r0], 0xc4}}, 0x0) executing program 1: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x10) r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @multicast2}, 0x10, &(0x7f0000000000)=[{&(0x7f00000002c0)="2a00a0df167e6d22", 0xffdf}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a0101027f000001010e0000001c000000000000000001000008"], 0x40}, 0xee00) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x51}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x6f}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_DREG={0x8}, @NFTA_BYTEORDER_SREG={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) r1 = syz_usb_connect$hid(0x5, 0x67, &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRESHEX=0x0, @ANYRESOCT=0x0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='tmpfs\x00', 0x16, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x10840b2, &(0x7f0000000080)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x37]}}]}) mount(0x0, &(0x7f0000003c40)='.\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000000)='gid=1\x00nk]e\xe5\xcd\xeb\x12\xcdx\xa6\xfb\xc7\f5\xaf\xea)\xfc\x80\x81X\xbb\xd33\xdf\bbx\x10\xa3\xc8n\xa4\'') syz_usb_connect(0x4, 0xeb1, &(0x7f0000000580)={{0x12, 0x1, 0x250, 0x4e, 0xb5, 0x24, 0xff, 0x846, 0x9055, 0xaabc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe9f, 0x4, 0x4, 0x5, 0x40, 0x0, "", [{{0x9, 0x4, 0xd6, 0x3, 0x1, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0x23, "00e69a62d5a83404c09bd9c277112245816899ea22768ff1042e4765cd2b771e6d16e073ae043d39eb4f3eb5b7b1ea62924ea7f522857786c54e45762b2d63"}, @uac_as={[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x0, 0x4, 0x3, 0x3c, "e9f2febe"}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x8, 0x8, 0xd, "f010"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0xa0d3, 0x9}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x7ff, 0x80, 0x0, "ea474b6dc1df3139"}]}], [{{0x9, 0x5, 0x0, 0x0, 0x20, 0x4, 0xc, 0x8, [@generic={0xf, 0x2, "926fd2e32c20416d370be2a420"}]}}]}}, {{0x9, 0x4, 0x55, 0x7, 0x9, 0xbb, 0xf7, 0xdb, 0x0, [@generic={0x98, 0xb, "b36213c296c2964e5aa99a39a8c6a867a96408d61393d0cc6f181f61ba349862f00a39616e18794d3736930b6d9f35999bf8cc2f375c87e113dd13b2f9005bdb5000cd775fe6cda280dba101e3f80e900f43f0d1ac5053a56660f8d0018bc914aadcbf05a6da5e41baf0bf2f6f8161c239a11020e0ce34c5aa75668c898bcd8abbb217036d7ec87266addd35ab714c5e73fa8e9c8d31"}, @cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "1f065937"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x7ff, 0xc}, [@mbim={0xc, 0x24, 0x1b, 0x7, 0x4, 0x0, 0x0, 0x7, 0x5}, @acm={0x4, 0x24, 0x2, 0xa}, @ncm={0x6, 0x24, 0x1a, 0x1000, 0x14}, @acm={0x4, 0x24, 0x2, 0x5}, @mbim_extended={0x8, 0x24, 0x1c, 0x7, 0x4b, 0x5}, @acm={0x4, 0x24, 0x2, 0x1}]}], [{{0x9, 0x5, 0xd, 0x0, 0x3ff, 0x52, 0x9, 0x2}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0xba, 0x8, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0xcfb1}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xfd, 0x8}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x2, 0x3, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6d, 0x7}, @generic={0xf4, 0x4, "b3a4ef789b0a3c938471f823d7393499420d3fa429ff8598f517a9b0689af51cee550f8bc928e88ca362d6c827df200a647e4811e75cc8938d3bc2b9b54de1fb7dbec06732eaf4f5d2d94ca94ce81bd13f85aa3e988ee213e7b5e68a74be4c7323562a0df2b35f2f54ddb149fdc70d919d04ffd3e542d821f7a6674f76a73a908b0bff7dc19b2fff1d24305ff3caefaf5e5723427cf7b7ef30494d0ee387883f472c9acc694305c10f1cb2648396fe03565b86a904fda2e3cc9e9a5635fc3ee797685c3ee3f0d62763636fb1e2f40c82b4ad6e973d6f80aa8a85f4798c4ffd99c610593d2a9ade06d1f2afcbe1153b0afb4e"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x10, 0x73, 0x8, 0xa, [@generic={0x39, 0x3, "be130844b708695eec83a630b38a5323b1cac1b3d518be8f5402ecc0759935ea165c6565b511b1e6a9b36718409453c19f615cb2efaf21"}]}}, {{0x9, 0x5, 0x4, 0x8, 0x3ff, 0x3, 0xe, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x101}]}}, {{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x4, 0xc0, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x45, 0x101}]}}, {{0x9, 0x5, 0x9, 0x10, 0x20, 0x40, 0xd9, 0x9, [@generic={0x29, 0xa, "d687cf856175433f8f63561f44d00d475522b2af084e1e3ce70a1937a459a7b5da1c2e1fef7ef7"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x3ff}]}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x2, 0x2, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xc, 0x7}]}}, {{0x9, 0x5, 0x4, 0x10, 0x10, 0x9, 0x7, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xe, 0x800}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x52, 0x8182}]}}]}}, {{0x9, 0x4, 0x26, 0x3, 0xe, 0x94, 0x55, 0xb1, 0x77, [@cdc_ncm={{0xa, 0x24, 0x6, 0x0, 0x1, "76910d5010"}, {0x5, 0x24, 0x0, 0xf}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6, 0xf, 0x3}, {0x6, 0x24, 0x1a, 0xf6c4, 0x1b}, [@mdlm={0x15, 0x24, 0x12, 0x3}, @dmm={0x7, 0x24, 0x14, 0x8, 0x5}, @mdlm_detail={0xfb, 0x24, 0x13, 0x1, "b20ce9b58a6c2930c0624a921c6307863546065274976db31d35463c73537572641c2d658eb815564c5cc3f7c7e4abbe2d9c72858477b3ecde0610c885fb8d7da77ba6ef62153fc58ebf63e17b1eb1edfd9752fb2934a87e90a374fc822860811208c2fe0179be835c78f8fc587fbce68b8e2a6d4fd15bc995f4e45ed2fd2599b2fc79e69036b7d4faa140a02ef18b6da7e91445bd6bd197e07d0535a7666e523a6cac3d4d14acc9cba290916937a463a87c7a9bfbb3cc10e7c66d6ea2e88d5a2464b69c7e3315c7fb5fdec55ebf615cf712ba714507feb72a8b82ae1ff10d06869adea7e73a92614b27fd76e4ad39e18fc7048386c2ca"}, @dmm={0x7, 0x24, 0x14, 0x5, 0xc944}]}, @uac_control={{0xa, 0x24, 0x1, 0x3, 0x2b}, [@extension_unit={0x8, 0x24, 0x8, 0x6, 0x4, 0x3, "a3"}, @selector_unit={0xb, 0x24, 0x5, 0x5, 0xf, "575842ba3310"}, @output_terminal={0x9, 0x24, 0x3, 0x5, 0x301, 0x2, 0x4, 0x7}, @selector_unit={0x5, 0x24, 0x5, 0x5, 0x5}]}], [{{0x9, 0x5, 0x8, 0x4, 0x200, 0x9, 0x6, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x7fff}]}}, {{0x9, 0x5, 0x2, 0x2, 0x20, 0x9, 0x4e, 0x9, [@generic={0xb, 0x1, "b3f165452bddcac839"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x0, 0x5d, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0x18e}]}}, {{0x9, 0x5, 0x1, 0x10, 0x40, 0x4, 0xee, 0x5, [@generic={0x8, 0x30, "c6e7b73b8c29"}]}}, {{0x9, 0x5, 0x1, 0xc, 0x8, 0x9, 0x9, 0xfa}}, {{0x9, 0x5, 0xf, 0x10, 0x40, 0x2, 0x0, 0xb0, [@generic={0x1b, 0x11, "60aed7e34004c2a37e20c7d24952a8f72dc154f1e80e3f2406"}]}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0xc, 0x83, 0xfe}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0xf, 0x7, 0x80}}, {{0x9, 0x5, 0x6, 0x8, 0x400, 0x6, 0x0, 0x2, [@generic={0xd7, 0x22, "bdde36aa4d0515a9a5cc08cf44892837877ff7a6bee9981010775a5e6dc4ff3d118708832a60ef38305e01324e4f4e5d4e12b997ed1a38cc5d4f4b4127a494f6cc5a0c6e3f38dc0263151c617c84356ea1f18cc92341b44969676e3c42a9d9d5112bcdbca27cc4c8767c917ccd7a2914c53799030d301fd09e7fa186584562e22c2d525953bc6830328206e6cfebf964e66feb5bbb28f2512eb8e3687c1ad1da28f3c6c8b43f1dd7b257ca79e817b1a2ed6d3306c56c60d84b5e0f13f4e1b1c2dbf6063eb0843d23b7256326a502234b1a9b153805"}]}}, {{0x9, 0x5, 0x6, 0x10, 0x3ff, 0x40, 0xfe, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x5, 0x5}, @generic={0xe, 0x11, "38e999a8fdebc1f60f1068c3"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x5, 0x6, 0x5, [@generic={0x5e, 0xf, "d48b10c6abfc33451597268954bb0505aa9882c3b4b0ecb90f5836e1bef87d55e16ba66fd53342c7bffcdebfed7d13eac9fd174ff704743ed08f3c1ea47d161c7302ba9522d2a3ea0b73642caa1f9b46ab08d5ff1c936d9224282e48"}, @generic={0xaa, 0x22, "68b24530fdc859401cfc4a2d447d5a14956d8ca893e294479cbac24a88f0c87ded42e8d2fdea0ab2d1ef1443c01805cf0c0ec486a8b877c61207ae6ce0d87b4aec1c46d4db25a0b9f9afd4211fb92d2c3e7a4f752f8a635c30f3848cc65ee8a8807fdd675a639bdb77abe25d4600cb34afdcbb850b47874ecff899c690fd70aba2630fff823e81c2f70864576121fcfe9586b9b7e02628c1d287b79881668919927767117d3c6ece"}]}}, {{0x9, 0x5, 0x6, 0x1, 0x400, 0x0, 0x2, 0xff}}, {{0x9, 0x5, 0xf, 0x10, 0x0, 0x3, 0xca, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x1000}, @generic={0xf1, 0x1, "544fb492130515433f556f6ff6394490c472d3791913821ad8a9678e9964369582c6d5203e6f4a17b71231541e1074101516e4d70fbf89cb8b1e61b8717d8b910b1751f76fed6a5f22c977f5b82abf5e95fd0013524fc4d705150e9803930908361380af4a1280f6e17e9727278754dc4547a426793391ef6eeddfb5b2b872aecf585da4383d0609e5331adf3d30aaaef4d11ce5e12c13a9b0737d91211c705e4dc67f2657cc0b8465fd771f14955a7e1b38fd2c15147de2397c84b9f1bc1423212fffafe44459ce619ac0dd887bead33347f5f3d574c2b7c6b9b6b15755ec726ee89d6387403a313f594ab571f533"}]}}, {{0x9, 0x5, 0x2, 0x2, 0x3ff, 0x3, 0x5, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x80, 0x4}]}}]}}, {{0x9, 0x4, 0x5b, 0xab, 0xf, 0xff, 0xff, 0xff, 0x5, [@generic={0xe4, 0x23, "9e1e56bf421c2b5002e45a2e188e2b3257daca54ac9e2e086d2bd5a936b1a65dfdff44ec87f2905b9b1de773adfc9f752209a3042c894b450c615cd425048141c52ca42615636d262a0abbcef09707912d1642b17e3156c0dda0bd6a449ee49b1dbd3e0d1218aab9c297b5f6bdb5a23dfcbd5c76ffc5f74858b7c1d5690d22e79ee085f849feb572a7a977f28a719fc4c38afebdfd6116e3df1d8d978bcf048c46afaf7908ab1d1fcb240fcab9cccd0d86f1451f641bd5b839f0d818e37bd340fe84833ed0b8f8112bdb9ab706d16a2e0257f55ab6bfb615930565b7e8db35439e7e"}, @uac_control={{0xa, 0x24, 0x1, 0x2, 0x36}, [@mixer_unit={0xa, 0x24, 0x4, 0x6, 0x5, 'm\\)3@'}, @input_terminal={0xc, 0x24, 0x2, 0x6, 0x404, 0x6, 0x7, 0x1, 0x3, 0x3}, @extension_unit={0xb, 0x24, 0x8, 0x2, 0x6, 0x7, "2cdc62ff"}, @extension_unit={0xb, 0x24, 0x8, 0x5, 0x5, 0x9, "56ecdaa1"}]}], [{{0x9, 0x5, 0x1, 0x0, 0x5b7, 0x86, 0x2, 0x10, [@generic={0xbd, 0x3, "b1607bdac896dd9a2efe5437d116c63ef71cee2bea41cc9697903c67e32da8c484b5b85e3cc5fc5cfccebdbe8be8b2eeb204efd0d89867d955613665aafaf998ca8f08a4cd2f1825c03518d23ece964417d4d89332436f07501989d917dbe427e3d8e52759c1e5362ce4c9201ad4dbe48cabb08993396c18c3489ba229e70d7de551794b0961d0e03e912c68e7568152ec126d3f3cb1d9cfa87ccadf9814fb9f1829fe6a8e6dc8a5bfaefedc58dac46306cbde7d57eae2c77ef064"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0xb, 0x1}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x3, 0xff, [@generic={0xc3, 0xd, "a8c0e6cf8dbe53fdd5d876df47eec0e756fcefeb3f6343dd80a89a2082ab1e6c5302d4da4b7f4b660391c8d108f6879411f28b7361c9e5704b2904b5c720f11e9b2bca44879199d91ec3d907593fd6c29db3c0897202922143d4d139aa16228d94e7a558dda32194d75ce09045798d0946f69e95ed275acc2aab10cc5f4c735df0dc2c16756ae69101232132441b8cab7af697fdd21658d84847c82df55145de346064a514dcb379b6dee8ff723c1ec29bab81dcc367f2ad5cc9a6613818583ef1"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x400, 0xd, 0x6, 0x36, [@generic={0x2a, 0x21, "b0508719375509f5ca258301e765552bf0f0d8248bf3bf89011fd19925e044be0e4bf22d83afa13a"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x8, 0x4, 0x2d, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x8, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x9, 0x2}]}}, {{0x9, 0x5, 0x0, 0x0, 0x58, 0x7, 0x5, 0x80, [@generic={0xad, 0x10, "297da0160dd1197be865c626c9be2741d6116f02b12109c8ee625d414de192c8d6cc695a70ac20dafb71655895f8bd3a7c80f90496519b0542c057734ba764cb9cb19e4b7e580d53399ba4311c878d545b95b9ee71eebea6725cf646ce077275cde91826367b53066905c1b1df45e5489eb8b04eefda4ef1a7a51daeb479235f59c12ab931bccf557c76d58707f183d2130d65420cc72ffd24cac70691e545a1047022ef147c2e69c0150c"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0xa5, 0x4, 0x48, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x0, 0x3}]}}, {{0x9, 0x5, 0x1, 0x19, 0x8, 0x2, 0xfd, 0x3}}, {{0x9, 0x5, 0x3, 0x8, 0x3ff, 0xa, 0x7, 0x1, [@generic={0x19, 0xf, "df00a11b3bd85f8b9d457e5a841194f3ec7d9d161720a2"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xa, 0xacbb}]}}, {{0x9, 0x5, 0xb, 0x6, 0x3ff, 0x3, 0x1, 0x21, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x8, 0x7}]}}, {{0x9, 0x5, 0x3, 0x0, 0x20, 0xc4, 0x2, 0x9, [@generic={0x3f, 0x23, "8252a34cd4cc3b6aa1339f08eb29f68b039159d17ff1687de108ea16a8f4b273ca2541648d84936f1615ee350f2180af23ed0faebcd3afb699dff445ad"}, @generic={0x23, 0x31, "8454e2a64449f8129451180f051344117ba3352375c392277b0cf9b6c26b7b52c2"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x400, 0x9, 0x5, 0x4}}, {{0x9, 0x5, 0x5, 0x3, 0x400, 0x7, 0x7, 0x1}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0x2a, 0x40, 0x6, [@generic={0xa9, 0x8, "f95eff5248cf3684538d753cb13eb29e90583ff26214df98a479260c5680027ca0d3050fbb570f88af2c97b1c00c3230224e9ccb32c6ec9c050e7fc837720bf1460ea2861ad02845bf149ac152fef10628e1148713552b1ab284095ae3eef8c678e733a8af0885f914c7d7a233a44864c408ef41fbc86c7f086682247b3041d6507ed4edb51640a21851bb0a02e4592af8949a63f9a196bd82d2d3d77f226884608d68ecbbdf29"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x2, 0x6b7f}]}}, {{0x9, 0x5, 0xe, 0x10, 0x200, 0x0, 0x6, 0xe, [@generic={0xb1, 0x7, "289e8adb1ca221c8a26edebe0b0268672f6e8bf47feacd71625e6379559d350d61db6b3c50125ee859955e6dcc4ab603f26083e9a16709802e8b67ae36266fc94d9b3cdcf71cebdd508655015c35bb9146aee45cf5aecc1fc15d1c1250cdaae55bbd2b825c99fc0122da34e8e550a9d945448262a10237f9316fbd91ede42f5d7e03436e6f4aaaddcfd1b33b6ac43de185c60df3c689c64b176c9052e6f414ea97560bba43c7f4968411104026a23a"}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x6, 0x4, 0xa, [@generic={0xc, 0xd, "5f10631fc1bd3ad0920a"}]}}]}}]}}]}}, &(0x7f00000017c0)={0xa, &(0x7f0000001440)={0xa, 0x6, 0x201, 0x5, 0x5, 0x3, 0x40, 0x81}, 0x23, &(0x7f0000001480)={0x5, 0xf, 0x23, 0x4, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xb, 0x6, 0x4, 0x7fff}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x1, 0xc, 0x3cc1}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x5, 0xf, 0x3ff}]}, 0x3, [{0x8f, &(0x7f00000014c0)=@string={0x8f, 0x3, "bdb5e1fec88a9c3fe4b14bdfe4eb493805c88a949a8fd6066f7b1802128bc6aaa3883cdc9263c0c94afdac463522021b78c96ffeb7a902bd306f3822f408b2dc92b694e216e802fa92dbe91f56317ee861d831c447430bcec94334e559e1fa81596c3b8028d9c56084635a5e381aeed2c5978877d99bb3c3715122d089463040ca773c3c838de61b8a86217e60"}}, {0x101, &(0x7f0000001580)=@string={0x101, 0x3, "367fba9c9ee2bc110dd0a70b340bf22f0cc13ff332ddad1cd9dac9f56877408a87113e79647c69569fb0f4ebf4589fe26f3bd7ac2ec252720ad72e3882c8c842a0a8cd06fa2fb7cde16826918bc5bbc376a6961460ac0fcc8bf206559efdab72277a70ea44cfd93c7f3fe823cdc096f71356657f3016a8afdc685344a7074b99acfee9a5db2394e50d819b7532f81d62be3860b950332281cce5acf7e783d625e4d6d993859afd33e2fcf00e68479eda6a7235b0da727ac15d1c525186b5200026df8cf3b8d4aecd46ae5d38b744f6559fba8a925b785e1c2928fa4379508d13b00274bf5ed671c58afd991c20ac507d408ff27cfbfab6d43190c214daf5cd"}}, {0xdf, &(0x7f00000016c0)=@string={0xdf, 0x3, "ca97eaf7594aa26669eeddcde946e2d95e5b1d8da31828f5c058e1ae4ff645a4af2ab903ee71a4218abd2966e54ed74cd476fc208f2ad631d2116ae2d162bef9951e274e012d0d2198a37ae86fd55af5e2e1af122e228e04bc4d5bc2c4ef4725f03e5d3653db39dc914d6d1991557b286e129afed2785bdd49eb179d9bc7591c5968e0f02fffc27e820e8c5246e955aa7eeaf9faa437ddf3a501eed92a6136ae66a36978521422cf371d5a3f37e5c0130e544cf36502d7502176b88d356973c0f1db18bca6d876bd5f436b02feee6928339c85faad2a99a770bd0c80ea"}}]}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000380)="a29c4cc9", 0x4}], 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_control_io(r1, &(0x7f0000000000)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB="0008290000006211826313612b8526792c3cbdeace918d0fb74237cc6e446c4e88e78881ce2a52973661d67a0c5544bb0e1b72a95c1747c51785cb7a3e84578c952f72558cfc038acfeeb44a0aa6264dad487f9473c3b2d195c2261605c4cc48a63d8fd78f846f0af62c60ac577913f3a79a292a80f148fe338d6d70914cdeb7e685de65ec4dd2234901bc7ed5000cd33004f2d53a6cf55799c158ae51ce0d8ae12f4259ad036d429de8e9d2bb548d79f1457d5169250eeee0f40cdba70acf40da0a01c8262f88dc69"], 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x51}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x6f}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_DREG={0x8}, @NFTA_BYTEORDER_SREG={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) (async) syz_usb_connect$hid(0x5, 0x67, &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRESHEX=0x0, @ANYRESOCT=0x0], 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='tmpfs\x00', 0x16, 0x0) (async) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x10840b2, &(0x7f0000000080)={[{@usrquota_block_hardlimit={'usrquota_block_hardlimit', 0x3d, [0x37]}}]}) (async) mount(0x0, &(0x7f0000003c40)='.\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000000)='gid=1\x00nk]e\xe5\xcd\xeb\x12\xcdx\xa6\xfb\xc7\f5\xaf\xea)\xfc\x80\x81X\xbb\xd33\xdf\bbx\x10\xa3\xc8n\xa4\'') (async) syz_usb_connect(0x4, 0xeb1, &(0x7f0000000580)={{0x12, 0x1, 0x250, 0x4e, 0xb5, 0x24, 0xff, 0x846, 0x9055, 0xaabc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe9f, 0x4, 0x4, 0x5, 0x40, 0x0, "", [{{0x9, 0x4, 0xd6, 0x3, 0x1, 0xff, 0xff, 0xff, 0x40, [@generic={0x41, 0x23, "00e69a62d5a83404c09bd9c277112245816899ea22768ff1042e4765cd2b771e6d16e073ae043d39eb4f3eb5b7b1ea62924ea7f522857786c54e45762b2d63"}, @uac_as={[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x0, 0x4, 0x3, 0x3c, "e9f2febe"}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x8, 0x8, 0xd, "f010"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0xa0d3, 0x9}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x7ff, 0x80, 0x0, "ea474b6dc1df3139"}]}], [{{0x9, 0x5, 0x0, 0x0, 0x20, 0x4, 0xc, 0x8, [@generic={0xf, 0x2, "926fd2e32c20416d370be2a420"}]}}]}}, {{0x9, 0x4, 0x55, 0x7, 0x9, 0xbb, 0xf7, 0xdb, 0x0, [@generic={0x98, 0xb, "b36213c296c2964e5aa99a39a8c6a867a96408d61393d0cc6f181f61ba349862f00a39616e18794d3736930b6d9f35999bf8cc2f375c87e113dd13b2f9005bdb5000cd775fe6cda280dba101e3f80e900f43f0d1ac5053a56660f8d0018bc914aadcbf05a6da5e41baf0bf2f6f8161c239a11020e0ce34c5aa75668c898bcd8abbb217036d7ec87266addd35ab714c5e73fa8e9c8d31"}, @cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "1f065937"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x7ff, 0xc}, [@mbim={0xc, 0x24, 0x1b, 0x7, 0x4, 0x0, 0x0, 0x7, 0x5}, @acm={0x4, 0x24, 0x2, 0xa}, @ncm={0x6, 0x24, 0x1a, 0x1000, 0x14}, @acm={0x4, 0x24, 0x2, 0x5}, @mbim_extended={0x8, 0x24, 0x1c, 0x7, 0x4b, 0x5}, @acm={0x4, 0x24, 0x2, 0x1}]}], [{{0x9, 0x5, 0xd, 0x0, 0x3ff, 0x52, 0x9, 0x2}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0xba, 0x8, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0xcfb1}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xfd, 0x8}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x2, 0x3, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6d, 0x7}, @generic={0xf4, 0x4, "b3a4ef789b0a3c938471f823d7393499420d3fa429ff8598f517a9b0689af51cee550f8bc928e88ca362d6c827df200a647e4811e75cc8938d3bc2b9b54de1fb7dbec06732eaf4f5d2d94ca94ce81bd13f85aa3e988ee213e7b5e68a74be4c7323562a0df2b35f2f54ddb149fdc70d919d04ffd3e542d821f7a6674f76a73a908b0bff7dc19b2fff1d24305ff3caefaf5e5723427cf7b7ef30494d0ee387883f472c9acc694305c10f1cb2648396fe03565b86a904fda2e3cc9e9a5635fc3ee797685c3ee3f0d62763636fb1e2f40c82b4ad6e973d6f80aa8a85f4798c4ffd99c610593d2a9ade06d1f2afcbe1153b0afb4e"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x10, 0x73, 0x8, 0xa, [@generic={0x39, 0x3, "be130844b708695eec83a630b38a5323b1cac1b3d518be8f5402ecc0759935ea165c6565b511b1e6a9b36718409453c19f615cb2efaf21"}]}}, {{0x9, 0x5, 0x4, 0x8, 0x3ff, 0x3, 0xe, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x101}]}}, {{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x4, 0xc0, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x45, 0x101}]}}, {{0x9, 0x5, 0x9, 0x10, 0x20, 0x40, 0xd9, 0x9, [@generic={0x29, 0xa, "d687cf856175433f8f63561f44d00d475522b2af084e1e3ce70a1937a459a7b5da1c2e1fef7ef7"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x3ff}]}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x2, 0x2, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xc, 0x7}]}}, {{0x9, 0x5, 0x4, 0x10, 0x10, 0x9, 0x7, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xe, 0x800}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x52, 0x8182}]}}]}}, {{0x9, 0x4, 0x26, 0x3, 0xe, 0x94, 0x55, 0xb1, 0x77, [@cdc_ncm={{0xa, 0x24, 0x6, 0x0, 0x1, "76910d5010"}, {0x5, 0x24, 0x0, 0xf}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6, 0xf, 0x3}, {0x6, 0x24, 0x1a, 0xf6c4, 0x1b}, [@mdlm={0x15, 0x24, 0x12, 0x3}, @dmm={0x7, 0x24, 0x14, 0x8, 0x5}, @mdlm_detail={0xfb, 0x24, 0x13, 0x1, "b20ce9b58a6c2930c0624a921c6307863546065274976db31d35463c73537572641c2d658eb815564c5cc3f7c7e4abbe2d9c72858477b3ecde0610c885fb8d7da77ba6ef62153fc58ebf63e17b1eb1edfd9752fb2934a87e90a374fc822860811208c2fe0179be835c78f8fc587fbce68b8e2a6d4fd15bc995f4e45ed2fd2599b2fc79e69036b7d4faa140a02ef18b6da7e91445bd6bd197e07d0535a7666e523a6cac3d4d14acc9cba290916937a463a87c7a9bfbb3cc10e7c66d6ea2e88d5a2464b69c7e3315c7fb5fdec55ebf615cf712ba714507feb72a8b82ae1ff10d06869adea7e73a92614b27fd76e4ad39e18fc7048386c2ca"}, @dmm={0x7, 0x24, 0x14, 0x5, 0xc944}]}, @uac_control={{0xa, 0x24, 0x1, 0x3, 0x2b}, [@extension_unit={0x8, 0x24, 0x8, 0x6, 0x4, 0x3, "a3"}, @selector_unit={0xb, 0x24, 0x5, 0x5, 0xf, "575842ba3310"}, @output_terminal={0x9, 0x24, 0x3, 0x5, 0x301, 0x2, 0x4, 0x7}, @selector_unit={0x5, 0x24, 0x5, 0x5, 0x5}]}], [{{0x9, 0x5, 0x8, 0x4, 0x200, 0x9, 0x6, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x7fff}]}}, {{0x9, 0x5, 0x2, 0x2, 0x20, 0x9, 0x4e, 0x9, [@generic={0xb, 0x1, "b3f165452bddcac839"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x0, 0x5d, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0x18e}]}}, {{0x9, 0x5, 0x1, 0x10, 0x40, 0x4, 0xee, 0x5, [@generic={0x8, 0x30, "c6e7b73b8c29"}]}}, {{0x9, 0x5, 0x1, 0xc, 0x8, 0x9, 0x9, 0xfa}}, {{0x9, 0x5, 0xf, 0x10, 0x40, 0x2, 0x0, 0xb0, [@generic={0x1b, 0x11, "60aed7e34004c2a37e20c7d24952a8f72dc154f1e80e3f2406"}]}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0xc, 0x83, 0xfe}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0xf, 0x7, 0x80}}, {{0x9, 0x5, 0x6, 0x8, 0x400, 0x6, 0x0, 0x2, [@generic={0xd7, 0x22, "bdde36aa4d0515a9a5cc08cf44892837877ff7a6bee9981010775a5e6dc4ff3d118708832a60ef38305e01324e4f4e5d4e12b997ed1a38cc5d4f4b4127a494f6cc5a0c6e3f38dc0263151c617c84356ea1f18cc92341b44969676e3c42a9d9d5112bcdbca27cc4c8767c917ccd7a2914c53799030d301fd09e7fa186584562e22c2d525953bc6830328206e6cfebf964e66feb5bbb28f2512eb8e3687c1ad1da28f3c6c8b43f1dd7b257ca79e817b1a2ed6d3306c56c60d84b5e0f13f4e1b1c2dbf6063eb0843d23b7256326a502234b1a9b153805"}]}}, {{0x9, 0x5, 0x6, 0x10, 0x3ff, 0x40, 0xfe, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x5, 0x5}, @generic={0xe, 0x11, "38e999a8fdebc1f60f1068c3"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x5, 0x6, 0x5, [@generic={0x5e, 0xf, "d48b10c6abfc33451597268954bb0505aa9882c3b4b0ecb90f5836e1bef87d55e16ba66fd53342c7bffcdebfed7d13eac9fd174ff704743ed08f3c1ea47d161c7302ba9522d2a3ea0b73642caa1f9b46ab08d5ff1c936d9224282e48"}, @generic={0xaa, 0x22, "68b24530fdc859401cfc4a2d447d5a14956d8ca893e294479cbac24a88f0c87ded42e8d2fdea0ab2d1ef1443c01805cf0c0ec486a8b877c61207ae6ce0d87b4aec1c46d4db25a0b9f9afd4211fb92d2c3e7a4f752f8a635c30f3848cc65ee8a8807fdd675a639bdb77abe25d4600cb34afdcbb850b47874ecff899c690fd70aba2630fff823e81c2f70864576121fcfe9586b9b7e02628c1d287b79881668919927767117d3c6ece"}]}}, {{0x9, 0x5, 0x6, 0x1, 0x400, 0x0, 0x2, 0xff}}, {{0x9, 0x5, 0xf, 0x10, 0x0, 0x3, 0xca, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x1000}, @generic={0xf1, 0x1, "544fb492130515433f556f6ff6394490c472d3791913821ad8a9678e9964369582c6d5203e6f4a17b71231541e1074101516e4d70fbf89cb8b1e61b8717d8b910b1751f76fed6a5f22c977f5b82abf5e95fd0013524fc4d705150e9803930908361380af4a1280f6e17e9727278754dc4547a426793391ef6eeddfb5b2b872aecf585da4383d0609e5331adf3d30aaaef4d11ce5e12c13a9b0737d91211c705e4dc67f2657cc0b8465fd771f14955a7e1b38fd2c15147de2397c84b9f1bc1423212fffafe44459ce619ac0dd887bead33347f5f3d574c2b7c6b9b6b15755ec726ee89d6387403a313f594ab571f533"}]}}, {{0x9, 0x5, 0x2, 0x2, 0x3ff, 0x3, 0x5, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x80, 0x4}]}}]}}, {{0x9, 0x4, 0x5b, 0xab, 0xf, 0xff, 0xff, 0xff, 0x5, [@generic={0xe4, 0x23, "9e1e56bf421c2b5002e45a2e188e2b3257daca54ac9e2e086d2bd5a936b1a65dfdff44ec87f2905b9b1de773adfc9f752209a3042c894b450c615cd425048141c52ca42615636d262a0abbcef09707912d1642b17e3156c0dda0bd6a449ee49b1dbd3e0d1218aab9c297b5f6bdb5a23dfcbd5c76ffc5f74858b7c1d5690d22e79ee085f849feb572a7a977f28a719fc4c38afebdfd6116e3df1d8d978bcf048c46afaf7908ab1d1fcb240fcab9cccd0d86f1451f641bd5b839f0d818e37bd340fe84833ed0b8f8112bdb9ab706d16a2e0257f55ab6bfb615930565b7e8db35439e7e"}, @uac_control={{0xa, 0x24, 0x1, 0x2, 0x36}, [@mixer_unit={0xa, 0x24, 0x4, 0x6, 0x5, 'm\\)3@'}, @input_terminal={0xc, 0x24, 0x2, 0x6, 0x404, 0x6, 0x7, 0x1, 0x3, 0x3}, @extension_unit={0xb, 0x24, 0x8, 0x2, 0x6, 0x7, "2cdc62ff"}, @extension_unit={0xb, 0x24, 0x8, 0x5, 0x5, 0x9, "56ecdaa1"}]}], [{{0x9, 0x5, 0x1, 0x0, 0x5b7, 0x86, 0x2, 0x10, [@generic={0xbd, 0x3, "b1607bdac896dd9a2efe5437d116c63ef71cee2bea41cc9697903c67e32da8c484b5b85e3cc5fc5cfccebdbe8be8b2eeb204efd0d89867d955613665aafaf998ca8f08a4cd2f1825c03518d23ece964417d4d89332436f07501989d917dbe427e3d8e52759c1e5362ce4c9201ad4dbe48cabb08993396c18c3489ba229e70d7de551794b0961d0e03e912c68e7568152ec126d3f3cb1d9cfa87ccadf9814fb9f1829fe6a8e6dc8a5bfaefedc58dac46306cbde7d57eae2c77ef064"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0xb, 0x1}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x3, 0xff, [@generic={0xc3, 0xd, "a8c0e6cf8dbe53fdd5d876df47eec0e756fcefeb3f6343dd80a89a2082ab1e6c5302d4da4b7f4b660391c8d108f6879411f28b7361c9e5704b2904b5c720f11e9b2bca44879199d91ec3d907593fd6c29db3c0897202922143d4d139aa16228d94e7a558dda32194d75ce09045798d0946f69e95ed275acc2aab10cc5f4c735df0dc2c16756ae69101232132441b8cab7af697fdd21658d84847c82df55145de346064a514dcb379b6dee8ff723c1ec29bab81dcc367f2ad5cc9a6613818583ef1"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x400, 0xd, 0x6, 0x36, [@generic={0x2a, 0x21, "b0508719375509f5ca258301e765552bf0f0d8248bf3bf89011fd19925e044be0e4bf22d83afa13a"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x8, 0x4, 0x2d, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x8, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x9, 0x2}]}}, {{0x9, 0x5, 0x0, 0x0, 0x58, 0x7, 0x5, 0x80, [@generic={0xad, 0x10, "297da0160dd1197be865c626c9be2741d6116f02b12109c8ee625d414de192c8d6cc695a70ac20dafb71655895f8bd3a7c80f90496519b0542c057734ba764cb9cb19e4b7e580d53399ba4311c878d545b95b9ee71eebea6725cf646ce077275cde91826367b53066905c1b1df45e5489eb8b04eefda4ef1a7a51daeb479235f59c12ab931bccf557c76d58707f183d2130d65420cc72ffd24cac70691e545a1047022ef147c2e69c0150c"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0xa5, 0x4, 0x48, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x0, 0x3}]}}, {{0x9, 0x5, 0x1, 0x19, 0x8, 0x2, 0xfd, 0x3}}, {{0x9, 0x5, 0x3, 0x8, 0x3ff, 0xa, 0x7, 0x1, [@generic={0x19, 0xf, "df00a11b3bd85f8b9d457e5a841194f3ec7d9d161720a2"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xa, 0xacbb}]}}, {{0x9, 0x5, 0xb, 0x6, 0x3ff, 0x3, 0x1, 0x21, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x8, 0x7}]}}, {{0x9, 0x5, 0x3, 0x0, 0x20, 0xc4, 0x2, 0x9, [@generic={0x3f, 0x23, "8252a34cd4cc3b6aa1339f08eb29f68b039159d17ff1687de108ea16a8f4b273ca2541648d84936f1615ee350f2180af23ed0faebcd3afb699dff445ad"}, @generic={0x23, 0x31, "8454e2a64449f8129451180f051344117ba3352375c392277b0cf9b6c26b7b52c2"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x400, 0x9, 0x5, 0x4}}, {{0x9, 0x5, 0x5, 0x3, 0x400, 0x7, 0x7, 0x1}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0x2a, 0x40, 0x6, [@generic={0xa9, 0x8, "f95eff5248cf3684538d753cb13eb29e90583ff26214df98a479260c5680027ca0d3050fbb570f88af2c97b1c00c3230224e9ccb32c6ec9c050e7fc837720bf1460ea2861ad02845bf149ac152fef10628e1148713552b1ab284095ae3eef8c678e733a8af0885f914c7d7a233a44864c408ef41fbc86c7f086682247b3041d6507ed4edb51640a21851bb0a02e4592af8949a63f9a196bd82d2d3d77f226884608d68ecbbdf29"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x2, 0x6b7f}]}}, {{0x9, 0x5, 0xe, 0x10, 0x200, 0x0, 0x6, 0xe, [@generic={0xb1, 0x7, "289e8adb1ca221c8a26edebe0b0268672f6e8bf47feacd71625e6379559d350d61db6b3c50125ee859955e6dcc4ab603f26083e9a16709802e8b67ae36266fc94d9b3cdcf71cebdd508655015c35bb9146aee45cf5aecc1fc15d1c1250cdaae55bbd2b825c99fc0122da34e8e550a9d945448262a10237f9316fbd91ede42f5d7e03436e6f4aaaddcfd1b33b6ac43de185c60df3c689c64b176c9052e6f414ea97560bba43c7f4968411104026a23a"}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x6, 0x4, 0xa, [@generic={0xc, 0xd, "5f10631fc1bd3ad0920a"}]}}]}}]}}]}}, &(0x7f00000017c0)={0xa, &(0x7f0000001440)={0xa, 0x6, 0x201, 0x5, 0x5, 0x3, 0x40, 0x81}, 0x23, &(0x7f0000001480)={0x5, 0xf, 0x23, 0x4, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xb, 0x6, 0x4, 0x7fff}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x1, 0xc, 0x3cc1}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x5, 0xf, 0x3ff}]}, 0x3, [{0x8f, &(0x7f00000014c0)=@string={0x8f, 0x3, "bdb5e1fec88a9c3fe4b14bdfe4eb493805c88a949a8fd6066f7b1802128bc6aaa3883cdc9263c0c94afdac463522021b78c96ffeb7a902bd306f3822f408b2dc92b694e216e802fa92dbe91f56317ee861d831c447430bcec94334e559e1fa81596c3b8028d9c56084635a5e381aeed2c5978877d99bb3c3715122d089463040ca773c3c838de61b8a86217e60"}}, {0x101, &(0x7f0000001580)=@string={0x101, 0x3, "367fba9c9ee2bc110dd0a70b340bf22f0cc13ff332ddad1cd9dac9f56877408a87113e79647c69569fb0f4ebf4589fe26f3bd7ac2ec252720ad72e3882c8c842a0a8cd06fa2fb7cde16826918bc5bbc376a6961460ac0fcc8bf206559efdab72277a70ea44cfd93c7f3fe823cdc096f71356657f3016a8afdc685344a7074b99acfee9a5db2394e50d819b7532f81d62be3860b950332281cce5acf7e783d625e4d6d993859afd33e2fcf00e68479eda6a7235b0da727ac15d1c525186b5200026df8cf3b8d4aecd46ae5d38b744f6559fba8a925b785e1c2928fa4379508d13b00274bf5ed671c58afd991c20ac507d408ff27cfbfab6d43190c214daf5cd"}}, {0xdf, &(0x7f00000016c0)=@string={0xdf, 0x3, "ca97eaf7594aa26669eeddcde946e2d95e5b1d8da31828f5c058e1ae4ff645a4af2ab903ee71a4218abd2966e54ed74cd476fc208f2ad631d2116ae2d162bef9951e274e012d0d2198a37ae86fd55af5e2e1af122e228e04bc4d5bc2c4ef4725f03e5d3653db39dc914d6d1991557b286e129afed2785bdd49eb179d9bc7591c5968e0f02fffc27e820e8c5246e955aa7eeaf9faa437ddf3a501eed92a6136ae66a36978521422cf371d5a3f37e5c0130e544cf36502d7502176b88d356973c0f1db18bca6d876bd5f436b02feee6928339c85faad2a99a770bd0c80ea"}}]}) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) (async) openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) (async) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000380)="a29c4cc9", 0x4}], 0x1) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_usb_control_io(r1, &(0x7f0000000000)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB="0008290000006211826313612b8526792c3cbdeace918d0fb74237cc6e446c4e88e78881ce2a52973661d67a0c5544bb0e1b72a95c1747c51785cb7a3e84578c952f72558cfc038acfeeb44a0aa6264dad487f9473c3b2d195c2261605c4cc48a63d8fd78f846f0af62c60ac577913f3a79a292a80f148fe338d6d70914cdeb7e685de65ec4dd2234901bc7ed5000cd33004f2d53a6cf55799c158ae51ce0d8ae12f4259ad036d429de8e9d2bb548d79f1457d5169250eeee0f40cdba70acf40da0a01c8262f88dc69"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x20, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x20}, 0x1, 0x0, 0x200000000000000, 0x885}, 0x48080) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/cpuidle/current_governor\x00', 0x2, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000580)={0xb, 0x29, 0x1, {0x9}}, 0xb) executing program 2: getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xb, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000009c0)="d80000001c0081064e81f782db44b9040a1d080404000000002181a1180002000600142603600e1208000fe52f01100100001605200001400200000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e40ae8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccc29e00360db70100000d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e7834", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x8000800) executing program 32: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x800, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x7}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000940)=ANY=[@ANYBLOB="400100001a000100feffffff00010000ac1e0101000000100000000000000000fc010000000000000000000000000001000107174e2300050a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc010000000000000000000000000001fe000000000000009201000000000010a39b000000000800ffff0000000000001c250800000000000500000000000000fcffffffffffffff0400000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffefffffff9030000000000007e00000005350000020001002000000000000000480003006465666c617465"], 0x140}}, 0x844) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x8e) fcntl$notify(r5, 0x402, 0x80000002) executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0xfffb, 0x9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000300)={r1, @in6={{0xa, 0x4e22, 0x7, @private1, 0x7f}}, 0x1, 0x7}, &(0x7f00000003c0)=0x90) r2 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0xb7, &(0x7f00000001c0)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x80, 0x1c, {0x80a, 0x9, 0x4, 0x7, 0x5, 0x3, 0x7, 0x7fffffff, 0x14, 0x9, 0x7e4, 0x2}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200f14"], 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x2004402, &(0x7f00000000c0)=ANY=[@ANYBLOB=',access=user,msize=0']) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000002c0)={0x40, 0x28}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0xfffb, 0x9}, &(0x7f0000000100)=0x8) (async) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000300)={r1, @in6={{0xa, 0x4e22, 0x7, @private1, 0x7f}}, 0x1, 0x7}, &(0x7f00000003c0)=0x90) (async) syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0xb7, &(0x7f00000001c0)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x80, 0x1c, {0x80a, 0x9, 0x4, 0x7, 0x5, 0x3, 0x7, 0x7fffffff, 0x14, 0x9, 0x7e4, 0x2}}, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200f14"], 0x0, 0x0, 0x0, 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1c1) (async) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x2004402, &(0x7f00000000c0)=ANY=[@ANYBLOB=',access=user,msize=0']) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000002c0)={0x40, 0x28}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000080)={0x24, r1, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_OUT_LEVEL={0x8, 0x2a, 0x4}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048894}, 0xc000) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000080)={@in={{0x2, 0x0, @multicast2}}, 0x3, 0x0, 0x1d, 0x2000, "5ec800000000000000e0ae479b418de13e4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e06627d1190000000000000000002000000000000000000200"}, 0xd8) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x3) close(0x3) r3 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000000)={r2, 0x1, 0x0, 0x2000}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40046201, &(0x7f0000000140)='log\x00') ioctl$sock_SIOCOUTQ(r0, 0x40086203, 0x0) executing program 3: connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4000, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1, 0x0, 0xfffffffe}}, 0x2e) (async) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4000, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1, 0x0, 0xfffffffe}}, 0x2e) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000040)={0x7f, 0xffffffffffffff14, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x7, 0xaf, 0xc, '\x00', 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/cpu/cpuidle/current_governor\x00', 0x2, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000580)={0xb, 0x29, 0x1, {0x9}}, 0xb) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') lseek(r0, 0xfffffffffffffff7, 0x1) semctl$IPC_INFO(0x0, 0x1, 0x3, &(0x7f0000000180)=""/82) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0xfffffffc}, 0x9) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x26, 0x12, 0xa01, 0x0, 0x0, {0x7}}, 0x26}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r2, 0x1, 0x2b, &(0x7f0000000240)=0x6, 0x4) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0xb4, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1000001}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}]}]}, 0xb4}}, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=r2, @ANYRESHEX=0x0, @ANYRESHEX=r2, @ANYRES16=0x0]) chdir(&(0x7f0000000140)='./file0\x00') copy_file_range(r2, 0x0, r2, &(0x7f00000001c0)=0xfffffffffffffffe, 0x5, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f00000004c0)={'#! ', '127.0.0.1:/test'}, 0x13) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x8e) fcntl$notify(r5, 0x402, 0x80000002) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io-syz_usb_control_io$rtl8150-setxattr$incfs_metadata-openat$dir-fcntl$notify detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x8e) fcntl$notify(r5, 0x402, 0x80000002) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode single: successfully extracted reproducer found reproducer with 24 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io-syz_usb_control_io$rtl8150-setxattr$incfs_metadata-openat$dir detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x8e) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io-syz_usb_control_io$rtl8150-setxattr$incfs_metadata detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f00000013c0)={0x14, &(0x7f0000001280)={0x20, 0xc, 0x2, {0x2, 0xf}}, 0x0}, 0x0) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-syz_usb_control_io detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) fsopen(&(0x7f0000000140)='cifs\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) r3 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) r3 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-chdir-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-mount-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mkdirat-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-socket$inet6_tcp-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) socket$inet6_tcp(0xa, 0x1, 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-sendmsg$nl_generic-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0xb0, 0x47, 0x107, 0x1, 0xffffffff, {0x8, 0x7c}, [@nested={0x9c, 0x3, 0x0, 0x1, [@nested={0x95, 0xf2, 0x0, 0x1, [@typed={0x8, 0x12f, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x14, 0xa6, 0x0, 0x1, [@nested={0x4, 0xa3}, @nested={0x4, 0x7c}, @typed={0x6, 0x86, 0x0, 0x0, @str=':\x00'}]}, @generic="5158bb8043e2b000bf6bf4e4cc5f1cedb20f5420ac375958a2b09dc4e794d709ef3e3020b64f7b2838f03b774e2271e2c573e2cd4266d032475edeec404ea4990784e2aed614c2f42d27bf2a170b37881ad2ae49f1f0550c9e4d16ac3cf9f7fcd575c287b59f258a25cb4a624683a7b3b3e90cec5a"]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2404c0d5}, 0xc000) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_STATION-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x27}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1000}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}]}, 0x54}}, 0x8001) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r1, &(0x7f0000000000)='3', 0x4e) r2 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', 0x0, &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000), 0x0) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-sendmsg$NFT_BATCH-mkdirat-mount-openat-write-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x178) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) chdir(&(0x7f0000000240)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x147) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode validation run: crashed=true reproducing took 1h43m14.24375613s repro crashed as (corrupted=false): RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f74b6c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f74b6e26038 R14: 00007f74b6e25fa0 R15: 00007fff61b089a8 ================================================================== BUG: KASAN: slab-use-after-free in jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 Read of size 4 at addr ffff8880325b21a8 by task syz.0.310/6721 CPU: 1 UID: 0 PID: 6721 Comm: syz.0.310 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 jffs2_do_clear_inode+0x58/0x390 fs/jffs2/readinode.c:1418 evict+0x624/0xb50 fs/inode.c:823 jffs2_new_inode+0x48a/0xd20 fs/jffs2/fs.c:-1 jffs2_mkdir+0x189/0xec0 fs/jffs2/dir.c:483 vfs_mkdir+0x40e/0x630 fs/namei.c:5423 filename_mkdirat+0x285/0x510 fs/namei.c:5456 __do_sys_mkdirat fs/namei.c:5477 [inline] __se_sys_mkdirat+0x35/0x150 fs/namei.c:5474 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f74b6b9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f74b79b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f74b6e25fa0 RCX: 00007f74b6b9e159 RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f74b6c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f74b6e26038 R14: 00007f74b6e25fa0 R15: 00007fff61b089a8 Allocated by task 6703: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:351 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:377 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4720 [inline] slab_alloc_node mm/slub.c:5033 [inline] kmem_cache_alloc_noprof+0x2b4/0x600 mm/slub.c:5047 jffs2_scan_make_ino_cache+0x89/0x1d0 fs/jffs2/scan.c:978 jffs2_scan_inode_node fs/jffs2/scan.c:1025 [inline] jffs2_scan_eraseblock fs/jffs2/scan.c:814 [inline] jffs2_scan_medium+0x35ac/0x7240 fs/jffs2/scan.c:151 jffs2_build_filesystem fs/jffs2/build.c:112 [inline] jffs2_do_mount_fs+0x775/0x22b0 fs/jffs2/build.c:416 jffs2_do_fill_super+0x555/0xc50 fs/jffs2/fs.c:574 mtd_get_sb+0x192/0x420 drivers/mtd/mtdsuper.c:59 get_tree_mtd+0x597/0x7d0 drivers/mtd/mtdsuper.c:143 vfs_get_tree+0x92/0x2a0 fs/super.c:1943 fc_mount fs/namespace.c:1209 [inline] do_new_mount_fc fs/namespace.c:3785 [inline] do_new_mount+0x319/0xdc0 fs/namespace.c:3861 do_mount fs/namespace.c:4194 [inline] __do_sys_mount fs/namespace.c:4407 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4384 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5744: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2780 [inline] slab_free mm/slub.c:6630 [inline] kmem_cache_free+0x182/0x650 mm/slub.c:6757 jffs2_free_ino_caches+0xec/0x1c0 fs/jffs2/nodelist.c:497 jffs2_put_super+0x6c/0x170 fs/jffs2/super.c:335 generic_shutdown_super+0x13d/0x2d0 fs/super.c:751 kill_mtd_super+0x23/0x70 drivers/mtd/mtdsuper.c:176 jffs2_kill_sb+0x96/0xb0 fs/jffs2/super.c:350 deactivate_locked_super+0xbe/0x110 fs/super.c:586 cleanup_mnt+0x3d3/0x460 fs/namespace.c:1329 task_work_run+0x1d9/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880325b2180 which belongs to the cache jffs2_inode_cache of size 48 The buggy address is located 40 bytes inside of freed 48-byte region [ffff8880325b2180, ffff8880325b21b0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x325b2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801e748b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000200400040 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5830, tgid 5828 (syz.0.17), ts 89085743032 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1854 prep_new_page mm/page_alloc.c:1862 [inline] get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3933 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5441 alloc_slab_page mm/slub.c:3384 [inline] allocate_slab+0x7d/0x5e0 mm/slub.c:3499 new_slab mm/slub.c:3550 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7539 refill_sheaf mm/slub.c:2917 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4811 alloc_from_pcs mm/slub.c:4887 [inline] slab_alloc_node mm/slub.c:5021 [inline] kmem_cache_alloc_noprof+0x394/0x600 mm/slub.c:5047 jffs2_do_read_inode+0x33f/0x6a0 fs/jffs2/readinode.c:1372 jffs2_iget+0x228/0xcc0 fs/jffs2/fs.c:277 jffs2_do_fill_super+0x59d/0xc50 fs/jffs2/fs.c:578 mtd_get_sb+0x192/0x420 drivers/mtd/mtdsuper.c:59 get_tree_mtd+0x597/0x7d0 drivers/mtd/mtdsuper.c:143 vfs_get_tree+0x92/0x2a0 fs/super.c:1943 fc_mount fs/namespace.c:1209 [inline] do_new_mount_fc fs/namespace.c:3785 [inline] do_new_mount+0x319/0xdc0 fs/namespace.c:3861 do_mount fs/namespace.c:4194 [inline] __do_sys_mount fs/namespace.c:4407 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4384 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 page last free pid 15 tgid 15 ts 88711812410 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1401 [inline] __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2952 __tlb_remove_table_free mm/mmu_gather.c:226 [inline] tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x926/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x223/0x840 kernel/softirq.c:645 run_ksoftirqd+0x36/0x60 kernel/softirq.c:1099 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff8880325b2080: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ffff8880325b2100: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc >ffff8880325b2180: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ^ ffff8880325b2200: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ffff8880325b2280: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ================================================================== final repro crashed as (corrupted=false): RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f74b6c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f74b6e26038 R14: 00007f74b6e25fa0 R15: 00007fff61b089a8 ================================================================== BUG: KASAN: slab-use-after-free in jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 Read of size 4 at addr ffff8880325b21a8 by task syz.0.310/6721 CPU: 1 UID: 0 PID: 6721 Comm: syz.0.310 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 jffs2_do_clear_inode+0x58/0x390 fs/jffs2/readinode.c:1418 evict+0x624/0xb50 fs/inode.c:823 jffs2_new_inode+0x48a/0xd20 fs/jffs2/fs.c:-1 jffs2_mkdir+0x189/0xec0 fs/jffs2/dir.c:483 vfs_mkdir+0x40e/0x630 fs/namei.c:5423 filename_mkdirat+0x285/0x510 fs/namei.c:5456 __do_sys_mkdirat fs/namei.c:5477 [inline] __se_sys_mkdirat+0x35/0x150 fs/namei.c:5474 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f74b6b9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f74b79b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f74b6e25fa0 RCX: 00007f74b6b9e159 RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f74b6c3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f74b6e26038 R14: 00007f74b6e25fa0 R15: 00007fff61b089a8 Allocated by task 6703: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:351 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:377 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4720 [inline] slab_alloc_node mm/slub.c:5033 [inline] kmem_cache_alloc_noprof+0x2b4/0x600 mm/slub.c:5047 jffs2_scan_make_ino_cache+0x89/0x1d0 fs/jffs2/scan.c:978 jffs2_scan_inode_node fs/jffs2/scan.c:1025 [inline] jffs2_scan_eraseblock fs/jffs2/scan.c:814 [inline] jffs2_scan_medium+0x35ac/0x7240 fs/jffs2/scan.c:151 jffs2_build_filesystem fs/jffs2/build.c:112 [inline] jffs2_do_mount_fs+0x775/0x22b0 fs/jffs2/build.c:416 jffs2_do_fill_super+0x555/0xc50 fs/jffs2/fs.c:574 mtd_get_sb+0x192/0x420 drivers/mtd/mtdsuper.c:59 get_tree_mtd+0x597/0x7d0 drivers/mtd/mtdsuper.c:143 vfs_get_tree+0x92/0x2a0 fs/super.c:1943 fc_mount fs/namespace.c:1209 [inline] do_new_mount_fc fs/namespace.c:3785 [inline] do_new_mount+0x319/0xdc0 fs/namespace.c:3861 do_mount fs/namespace.c:4194 [inline] __do_sys_mount fs/namespace.c:4407 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4384 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5744: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2780 [inline] slab_free mm/slub.c:6630 [inline] kmem_cache_free+0x182/0x650 mm/slub.c:6757 jffs2_free_ino_caches+0xec/0x1c0 fs/jffs2/nodelist.c:497 jffs2_put_super+0x6c/0x170 fs/jffs2/super.c:335 generic_shutdown_super+0x13d/0x2d0 fs/super.c:751 kill_mtd_super+0x23/0x70 drivers/mtd/mtdsuper.c:176 jffs2_kill_sb+0x96/0xb0 fs/jffs2/super.c:350 deactivate_locked_super+0xbe/0x110 fs/super.c:586 cleanup_mnt+0x3d3/0x460 fs/namespace.c:1329 task_work_run+0x1d9/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880325b2180 which belongs to the cache jffs2_inode_cache of size 48 The buggy address is located 40 bytes inside of freed 48-byte region [ffff8880325b2180, ffff8880325b21b0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x325b2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801e748b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000200400040 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5830, tgid 5828 (syz.0.17), ts 89085743032 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1854 prep_new_page mm/page_alloc.c:1862 [inline] get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3933 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5441 alloc_slab_page mm/slub.c:3384 [inline] allocate_slab+0x7d/0x5e0 mm/slub.c:3499 new_slab mm/slub.c:3550 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7539 refill_sheaf mm/slub.c:2917 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4811 alloc_from_pcs mm/slub.c:4887 [inline] slab_alloc_node mm/slub.c:5021 [inline] kmem_cache_alloc_noprof+0x394/0x600 mm/slub.c:5047 jffs2_do_read_inode+0x33f/0x6a0 fs/jffs2/readinode.c:1372 jffs2_iget+0x228/0xcc0 fs/jffs2/fs.c:277 jffs2_do_fill_super+0x59d/0xc50 fs/jffs2/fs.c:578 mtd_get_sb+0x192/0x420 drivers/mtd/mtdsuper.c:59 get_tree_mtd+0x597/0x7d0 drivers/mtd/mtdsuper.c:143 vfs_get_tree+0x92/0x2a0 fs/super.c:1943 fc_mount fs/namespace.c:1209 [inline] do_new_mount_fc fs/namespace.c:3785 [inline] do_new_mount+0x319/0xdc0 fs/namespace.c:3861 do_mount fs/namespace.c:4194 [inline] __do_sys_mount fs/namespace.c:4407 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4384 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 page last free pid 15 tgid 15 ts 88711812410 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1401 [inline] __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2952 __tlb_remove_table_free mm/mmu_gather.c:226 [inline] tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:287 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x926/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x223/0x840 kernel/softirq.c:645 run_ksoftirqd+0x36/0x60 kernel/softirq.c:1099 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff8880325b2080: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ffff8880325b2100: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc >ffff8880325b2180: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ^ ffff8880325b2200: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ffff8880325b2280: fa fb fb fb fb fb fc fc fa fb fb fb fb fb fc fc ==================================================================