Extracting prog: 3m46.636848885s Minimizing prog: 9m17.236101131s Simplifying prog options: 3m0.001213499s Extracting C: 40.745799095s Simplifying C: 0s extracting reproducer from 24 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 17, 29, 38, 17, 30, 7, 8, 16, 10, 2, 7, 6, 8, 30, 7, 17, 11, 10, 14, 5, 18, 4, 4] detailed listing: executing program 3: r0 = userfaultfd(0x801) timer_create(0x6, &(0x7f00000002c0)={0x0, 0x21, 0x1, @thr={&(0x7f0000000340)="2d9fa93f37a78a010645ea0569e236ffa0ce1c9b1d06a9ef34bf5acc774ba7b5554a468492f680431e716309637451d98f0712fc1fcb4b5b0f34c2bf6798ab47ac03f8a1522bd4c07116aa04945226542c1f4d5e3ea6d94088faa397b8d4d1eb9acf82e72d4ca745ea56f49945d046368e27971af274b958ec2bbc39", &(0x7f00000003c0)="6858fe61c97cfde8192e72ec30b9d7110a3e3ed1a1e4f640087d91f8d6df0538ff9b84dc0080a94b0d192865e9a792feb3191b181b61b4f8b3bab23e41f37946d09ef4fc04a8de7338246f45076c40c4e2a3febbae3b659f4db9d460ff7481badf3920bf8a5458ebc3e08e1b6691a7d97509"}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="240000001a0001000000ff7f000000008094"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'pcl812\x00', [0x140, 0x2, 0x3, 0xff, 0x1, 0x2, 0x7ffd, 0x6, 0x8, 0xf, 0x2, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9b, 0x8000, 0x401, 0x9, 0x8, 0x4, 0xf, 0xa, 0x9, 0xffd, 0x200000, 0xaf, 0x0, 0x10201fc, 0x0, 0x2]}) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendmmsg$inet(r3, &(0x7f0000001480)=[{{&(0x7f0000000100)={0x2, 0x6e20, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0x68, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0xd, @multicast1}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='0:,:\x00', 0x0) read(r5, &(0x7f0000000080)=""/72, 0x48) r6 = socket$inet6(0xa, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'bond_slave_1\x00'}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@ipv6_getanyicast={0x14, 0x3e, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000) r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) openat$cgroup_ro(r7, &(0x7f00000000c0)='blkio.throttle.io_serviced\x00', 0x0, 0x0) sendto$inet(r3, &(0x7f0000000c80)="e8", 0x6200, 0x12000000, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f0000000600)='3\n\x00', 0x2) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) executing program 3: r0 = socket$kcm(0xa, 0x5, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', &(0x7f0000000300)='pstore\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000640)="a06eea64ed8b0746b513d36ad02e2f66696c65300a08240202ed17d70819b4978921ff912341061b306b9482234c4d83a40c3243e5fa4271d8efb5c532c48caf17f400ebf3ef", 0xfffffffffffffe7a) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r6, &(0x7f0000000600)='loop\n', 0x5) close(r6) symlinkat(&(0x7f00000001c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', r1, &(0x7f0000000140)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) write(r7, &(0x7f0000000800)='transport=loop,nqn=testsubsys\n', 0x1e) nanosleep(&(0x7f0000000840)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff) sendfile(r7, r5, &(0x7f0000000280)=0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000008c0)='./sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nvmet/subsystems/testsubsys\x00', 0x400, 0x41) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000480)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = creat(&(0x7f0000000040)='./file1\x00', 0x1f1) recvmmsg(r2, 0x0, 0x0, 0x10100, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) write(r4, &(0x7f00000001c0)="1aace00cc337da1efbd7f84aee71ebde5097d88fd2781df3e236ef63b676a799f575bf6484193fa39c48040c3a88d7dea4e5a2f2a4f5969db50d5fadb5a2fa3388c5fa1e91c17a2f04", 0x49) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000240)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0x12, 0x600, 0x0, 0x202, 0x200, 0x2e8, 0x2e8, 0x200, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @private1, [0xffff00, 0xff000000, 0xffffff00, 0xffffff00], [0xff, 0xff000000, 0xffffff00], 'dvmrp1\x00', 'ip_vti0\x00', {}, {0xff}, 0x1d, 0x6b, 0x0, 0x44}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0xa, 0x6, 'snmp\x00', {0x4}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x3, 0x6, 0x8e1, 'snmp\x00', 'syz0\x00', {0xa136}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000080)={0x4, 0x6, 0xb, 0x7, 0x2, 0x3ff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, 0x0}) listen(0xffffffffffffffff, 0x80000000) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0xa, 0x0) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="24000000240035b90000000000000000070000000600040000ef0000060003"], 0x24}}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file1\x00', 0x0, 0x18, r3}, 0x18) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) (async) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000480)) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) creat(&(0x7f0000000040)='./file1\x00', 0x1f1) (async) recvmmsg(r2, 0x0, 0x0, 0x10100, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) connect$inet(r4, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) (async) write(r4, &(0x7f00000001c0)="1aace00cc337da1efbd7f84aee71ebde5097d88fd2781df3e236ef63b676a799f575bf6484193fa39c48040c3a88d7dea4e5a2f2a4f5969db50d5fadb5a2fa3388c5fa1e91c17a2f04", 0x49) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000240)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0x12, 0x600, 0x0, 0x202, 0x200, 0x2e8, 0x2e8, 0x200, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @private1, [0xffff00, 0xff000000, 0xffffff00, 0xffffff00], [0xff, 0xff000000, 0xffffff00], 'dvmrp1\x00', 'ip_vti0\x00', {}, {0xff}, 0x1d, 0x6b, 0x0, 0x44}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0xa, 0x6, 'snmp\x00', {0x4}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x3, 0x6, 0x8e1, 'snmp\x00', 'syz0\x00', {0xa136}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) (async) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000080)={0x4, 0x6, 0xb, 0x7, 0x2, 0x3ff}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, 0x0}) (async) listen(0xffffffffffffffff, 0x80000000) (async) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) mount$9p_fd(0x0, 0x0, 0x0, 0xa, 0x0) (async) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="24000000240035b90000000000000000070000000600040000ef0000060003"], 0x24}}, 0x0) (async) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file1\x00', 0x0, 0x18, r3}, 0x18) (async) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f0000000600)='3\n\x00', 0x2) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) executing program 0: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x1) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) getdents64(r4, &(0x7f00000005c0)=""/4096, 0x1000) setsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x404400, 0x0) epoll_create(0x9) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000380)={{0x1, 0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000340)='%pi6 \x00'}, 0x20) close_range(r6, r7, 0x0) r8 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r10, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x8, 0x1, 0x1009, 0x7f}, {0x12, 0x2, 0x0, 0x401, 0x8001}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd2b, 0x2, {0x60, 0x0, 0x0, r10, {}, {0xfff1, 0xa}, {0x0, 0x5}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x10) r11 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_emit_vhci(&(0x7f0000000440)=@HCI_EVENT_PKT={0x4, @hci_ev_keypress_notify={{0x3c, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}}}, 0xa) ioctl$VIDIOC_DECODER_CMD(r11, 0xc0485660, &(0x7f0000000280)={0x0, 0x43d9102d65573c3, @start={0x8}}) sendmsg$nl_route(r6, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv6_newroute={0x24, 0x18, 0x800, 0x70bd29, 0x25dfdbfc, {0xa, 0x14, 0x80, 0x7, 0x0, 0x4, 0xfd, 0xb, 0x2900}, [@RTA_IIF={0x8, 0x3, r10}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000001) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002000000001"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r12 = socket$l2tp(0x2, 0x2, 0x73) sendmmsg$inet(r12, &(0x7f0000001100)=[{{&(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10, 0x0}}], 0x1, 0x20000840) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x8080000, 0x58000, {}, 0x0, 0x7}, {"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000040)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e0000002ebe660f38049f9e0064f30fc7b000101f20f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f08b8f4008ee0", 0x5b}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 74) executing program 2: openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setrlimit(0xf, &(0x7f0000000000)={0x0, 0xff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x4, 0x7, 0x50000}]}) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r0, 0x5000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1802000083cd000000000000fdfffdff85000000cc00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000007ffec00b703000000000000850000007000004095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="440000000206030000000000000000000d0000000000020073797a320000000005005960f0032d00ed3610b0744059c6bb1a0400000000000900500073797a310000000005000500020000001c000100060000007b184a640459b3ffda548a178066c5d8777aa9e02387565a69478f656051f638be07e97b6384c94f9633a99e84f915f2458c9cdb658d00abc5568aeb01dc07804436dc1e631a4483738b543bdfe01eb169ed46a948d155805d9b24"], 0x2a}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000000000000000050000020500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x24000840}, 0x4800) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x10d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x6, 0x0, 0x0, 0x574aca18db6b83aa, 0x0, 0x0, 0x2}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x50, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_HANDLE_DFS={0x4}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffff7}], @NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x3}]}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x7}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x81}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40804}, 0x4040840) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x437, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50083, 0x2c01}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40850) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200) dup3(r1, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) executing program 0: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x2, &(0x7f0000000000)=@raw=[@call={0x85, 0x0, 0xd90f, 0x20}, @ldst={0x0, 0x1, 0x1, 0x8, 0x8, 0xfffffffffffffff8, 0xfffffffffffffffc}], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r1, 0x84, 0x19, 0x0, 0x0) write$sysctl(r1, &(0x7f0000000100)='4\x00', 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="002145000b2c000b0000400600000a0000010a000002005000500000000200000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) (fail_nth: 3) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f00000008c0)={'sit0\x00', &(0x7f0000000880)={@empty, @broadcast, 0x1e, 0x12}}) creat(&(0x7f0000000280)='./file0\x00', 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x0, 0x0, 0x29, 0x0, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x40086603, &(0x7f0000000040)) mount$9p_virtio(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2000000, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=virtio,access=', @ANYRESDEC]) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000008c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000040)=0x40, 0x4) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) setsockopt$inet6_int(r3, 0x29, 0x42, &(0x7f0000000180)=0x5, 0x4) sendmmsg$inet6(r3, &(0x7f0000004cc0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000048c0)="04e9", 0x2}], 0x1}}], 0x1, 0x4000001) r4 = dup(r3) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, '\x00', "de0000006deed7f21d74bc440900", "9884f958", "fc4bd6b33a9b93ca"}, 0x28) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{0x7f, 0x9, 0xd5, 0x401}, {0x0, 0x6, 0x8, 0x3}, {0x5, 0x1, 0x9, 0x4}, {0x37c, 0x66, 0x6, 0x1ff}, {0x8, 0x8, 0x3, 0x5}, {0x6, 0x1, 0x80, 0x7}]}) r6 = syz_open_dev$hidraw(&(0x7f0000000280), 0x0, 0x2) write$hidraw(r6, &(0x7f0000000000)='\x00\x00', 0x2) close_range(r5, 0xffffffffffffffff, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000001080)='a', 0x1) mkdirat(r0, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x40480923, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='3\n', 0x2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) executing program 1: r0 = syz_open_dev$I2C(&(0x7f00000002c0), 0x0, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000001380)={0x0, 0xc0, 0x5, &(0x7f0000000300)={0xc, "c8660972daadf38033035d21dcc910b0dbf5be74076dc3f2f67b364ef9ed965b13"}}) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = socket$packet(0x11, 0x2, 0x300) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010102d1a05e20cd0c02010e8901fc03010902120001085440010904"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) read(r2, 0x0, 0x0) (async) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r1, 0x0) (async) mremap(&(0x7f000000e000/0x7000)=nil, 0x7000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) (async) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200) dup3(r1, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @ioapic={0x26000, 0x80000000, 0x2, 0x30000, 0x0, [{0xd3, 0x4, 0x3, '\x00', 0xff}, {0x70, 0x66, 0x2, '\x00', 0x7}, {0x8, 0x6, 0x4, '\x00', 0x4}, {0x7a, 0xa, 0x8, '\x00', 0x3}, {0x9, 0x1, 0x0, '\x00', 0x4}, {0x7f, 0x6, 0x0, '\x00', 0x33}, {0x10, 0x81, 0x81, '\x00', 0x3}, {0x1, 0x1, 0x3, '\x00', 0x3}, {0x81, 0x7, 0x3, '\x00', 0x9}, {0x4, 0x9, 0x0, '\x00', 0x2}, {0x7, 0x7, 0x3, '\x00', 0x9}, {0x81, 0xff, 0x7e, '\x00', 0x4}, {0x0, 0x7, 0x4, '\x00', 0x7}, {0x9, 0x0, 0x7f, '\x00', 0xf}, {0x1, 0x5, 0x0, '\x00', 0x7f}, {0x40, 0xd, 0x1, '\x00', 0x6}, {0x0, 0x2, 0x3, '\x00', 0x9}, {0x18, 0x1, 0x8, '\x00', 0x8}, {0x60, 0x1, 0x2, '\x00', 0x8}, {0x40, 0x4, 0x4, '\x00', 0x9}, {0x2, 0x9, 0x81, '\x00', 0x4}, {0x1, 0x6, 0x1, '\x00', 0x8}, {0x7, 0xe2, 0x5, '\x00', 0xd}, {0x3, 0x0, 0x92, '\x00', 0xff}]}}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x368, 0x228, 0x2d0, 0xffffffff, 0xd8, 0x170, 0x2d0, 0x2d0, 0xffffffff, 0x2d0, 0x2d0, 0x5, 0x0, {[{{@ip={@rand_addr=0x640100fc, @rand_addr=0x64010101, 0xff, 0x0, 'veth1_macvtap\x00', 'ipvlan1\x00', {0xff}, {}, 0x33, 0x2, 0x14}, 0x0, 0xa0, 0xd8, 0x48, {}, [@common=@ah={{0x30}, {[0x1, 0x3], 0xff}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x67, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @empty, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @gre_key=0xe, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x200, 0x248, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r0 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) fsmount(0xffffffffffffffff, 0x1, 0xa) write$hidraw(r0, 0x0, 0xfffffd74) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000300)={0x0, 0x30000, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x840) executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x700, 0x0, 0xfffffffffffffffa, 0x0, 0xfffffffffffffffd}, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f00000042c0)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000340)="1e8395e2bd0d152628c70305dc1d683bba23ac1353f39f6c1d1ebdeb81ac6b0b1b6d21098503a16294770cec5e5dabf9645f63b09f7d700b7ea791ddc83f242125fcc466efccd7d3b7f428488301ed8885fb2f74baba39043d7c2195ead98b9c2b7e7402771164ba1b91e1bf60b2d68b4f16b6d8163c62e3981d6b1c713fbb39fd0f5fad509a225d1c97798ba92d471ac3ee4fa61b42f670e7fb6b87e5e2ece519d623f156e6475fb773dd9ca9bb2482c5d1a05e66bab288d99ec1db3f1cf3fafe5c17dd51371596371a40ef9245c4959416e87865375f4a947b1e64395600a101503f6a7da4229c65264115f0a4136d271abb5c1d0958e8ba9ff721dc800d9d1c15ee3af05478431867addab50a9f374b57fa450751c06a69a2eb9830b7aef3004bfdc92a6944885db52dac9c3c57a8f132621ef46308c3fc3b9cb93410a34fa959dde11d8bca0ee6a79bed302acc5666e6cdbccfdef977798e844b2fda3246e4b9ab3e3be51ef08dd3c51070e0cd965124bc9663faceebb3e878358c5de8a1510c8754e7cdaf2f2d6a0b8862d83a9cd57141deb0057c26544083fa1acf6abc25cb8ccdd15e7fb85a22791d538a8bcd45811466a3e460e70325f5e4ef4ba2f749bcaba2d9d3bc8de5d23879fb70bc258fa67268cbb27c60279055f8c3bb8869c22696d6ee1ef3fccaddda098fda773afddc02c8a5c4d1b89d85326233689dfb2c456b4a5b7f0fba2763d452d3abcb028122263342a66993db2391e26217d71dcab7f71bc7b35fefa4db0dea72aaa5f8edffd4ddb2c8e5c2243bccec57d133530617886bd1f0c981a921c66ed8c3dd4f39577fa782ac66fcde68ad2d86b6c6ead9fbc98acae404223e7d9461689816ec6990ccff32db513c0e4abe46bcdcebe804722e4299045c6263c0d4d79237564c01b5bd27d157d82ed7be47d4c786fa609899d830aa88d8341a7c8906fc0857f0b8553f47880b63bc357bb864f6df27b74bba838b78089f7c78e5e45597c6d7f10e0095c2df3cb654aa51efaab8b7a9b935ee54c302ed0f98f8a01cfe250bd54b5812ccb118e48edaf83664bfec7cbf911121cd58aeed23892c7a21db1d57eb62cccca4d1040e07e859e93f146ec6a5c95e99ff786b573da0ad1b13232727ac6b33b32f5d5226fdf36bc23f4741724ba6482c695281d5644be86550bc916a3f5a6ec274a57429d98421a042a2eee561fa64279270fbfaf07e638b43623726ed1242d341d1dc8a4f6ec52915c518178b1638675af7687763aff23cf75b831484dd1a669022a5a2c8599dff7909e7368700a6de96dbb39c65bfd572ac78fe93dc61466556a70fa4ff52c39fc8b9e12e4e3ca964937a2ca7fbf08ffa8b2844c47678dc0850e68646f35364f11b71b27f6729fe96547c8f8e6ce4beb6d95283f3537f2b76cd05c97f1364d87b9a36ce8fc7fb16e5df9d10979de8fd7153b84a784905122587713d0fd527ae215f1127bf4f351f786e7da4c19bedbb92633b842bec3570d102ca2ae7b764310314d6deaf916e91ca891e7b4622c7d045cccf21b9ac49834bf50f16538d02d11ac784252e656b9fda0ccf2583e401e8f6f2164ebae8e21c8b5bd417658ecca2f56ea57a0f44b8c93aee09843b79f449d214876fbd1078160c450dbf4e3988eabe294e2cb6688af4a2d162136e24727a646d52cdc585c1582686198819984327839f332fc57eb65d0ff0208c14c73ecf57003151f71bb7cc7663c6557ee30a3b4d40480530ac7aea0b4aeaebe2a9561339c8aea909cc68debcbd26d368bd43a2068ba0d97d54ec1903a7788da2b42ee16182973e25808050552c67a97354d264b5d64a97713095bf96b10079dd8b4d0c9376f6d7feb15d35b43a4eb95b15463faa3c1cf32de42124c49504b83a80b0044d0239e1b4fae9805e7ca2030a211bfd3505b94be04abe6a50a4a3fd39dcba7cf2f6e5db1191323743ab11de2d6c3eea280a61dcf483477c1c04c62b54053be8b51995cd267a786bf997412f812fe4b7891955f9bb6458a5805fc6e2239a22ee3b7bbab96b10d64d6848468cedf34512bd075c372ebfeae9ea9782147997fccf6ae6d7591cd8c1899fe1ccaadc828c68e41c1949dc0d531f266dcc3db92dd64633a9c35c890dc7e17b2eef8cb33b47558d42b0e4310a7247759870c2392792b64e7e8a34b6de9b516fabb61d8cf477cea91a63c68d6229e4e4d0580ea464e3cdf0de1a0f0ee90d9d107c37476c30ef3f270429763f28aff38931cadd263fd3fd18fcbf1046ac1097f2c95e84cc9e582c9f84d0c9a9b011ce60fc8d39a0f21f8d51ed4f3195e65de3f2c1e1b2d2608bdbdc041ea42a46b1aaa6c150d27a1a27d04e638e8cc92af3187ee72eade3b8373ffc8bf8445e940c43f51713875248002a84583a0ea604e7a49a90751970266b3cb6bfa0e91ed6afb059386eca70eedb3c05d355161f11dc7644beaee7a2453af13d1060e69ed5a2fb77a8650824d0cb5e7c6b8cd75955246064332d1a774218946f82d57ac514026ab2dd425eb026b6abc3df0f756af26299cd8e20895b7c4f155581ad4fb36c3cab418f37cae4cac3cfcfdb6c5ae1452ea047ab26d6f2aea0310d38e34bbb88d418e7fa681af0c3442907d6ae3342a7066cb1b004339a69e2da89b9d53d6433c6133e6b560038fa7fbaae36c3f649290166fbc8a5018e7357d5639c85c1612aa5f395f23abe3e206d1e51d2db1c55887c65e5f47aace8c159d20c6a57bc71ea4eb7ae839f682d93bd8441366dac3f48156bbf971b1da96d46352f3da31b59646e38483e8daff62aa25e339b9bb27a500ef35c6b169b37aed9044666b04a9a668df87a0aea02edde2eef0ad2dd866117419b93b9d7e63709885478d165473bb2fba5bf2b1651b59930530f2a3b418a9b616bb3f9692f51f63873b31f173d3555db4d304fa39a21574cb9fb2cdbca2874f5db8c0e3a134c7132a8ece82448683564550e14e9e004c8f5d3dbd1956d5983694f47d6861c563819d16bb7bae03db5ef7b0421723d5a2c1f305913ee8c1cff8435bff588e2f4b0c929d512fc5058730de63753d64965714047b37eab93ab6fc7b570cd3aa7ef2e5f95237b481a44057c0697b0d1a1ecbcbe72cecc7a9e69818140810c086c0786c05c081100165d501775674cd1bc10c8fa97237e6e3901b64861f92af1601081057f62513fc5f82cfbb5b4ad3e90b65e7f2767d5f379748d7f0ce0a9b8cdbb241d2a7b03173c1b6e5a36b3a6412a2f38330cadb3e00b4c235696353545867720d6e713b01359183a4cbba321c4da1d2d323d470836374e11cb200bde3645df5b4989c95b137aa0ca706d83f1175ee418d0ae1379c07e9d8d96c9883b2e60221d5d6556b04b5b825bee1c2d893537420ce4dcb17b2c25d29f4ebc0925abcdbaa94275b20762a2f858aac6c4f6c06dadb8809805416cde95861455915e2ac9f806a34e8097c9671b7f88afb0d8e72b6b3357666bd1ae8bc24b722db69be36c0bce96472ca40adfd12f95c0abd70c406787416e92cb07493f5eb7123d0c4d5f2f689d5e34a840d063a7a9dd5334e92f807d9f57513e6e954e7492e1a92f5a265110308c92bf926463c3452d8f8012e56178a85e60e8af568430d919cdcec4ea98756d624951ce3970bb5b9fd4c3e43bb11a7e0982ae628eaa272da927babdfb88f63179a4f752d09ddc0a462af6e123240e4b545ca7e27491e16603275ad84f676c6c488079c1fc30993256f59f8ce4fa53706c8f91f2d6f6e3c7a11696b8862e7a8097fcc8b9627aaeec7e0cadbfcd2506633da28dd28b17ed3336d5ff0a0cdedf606d812a8ad514fadb22697a3e2f92edda7e20160522ea85cfcf8636f43e638504c31e25b1eb40b1c6764f29d93e982affef5a1b3027de566554b634ba01f130b116808f1c5fbd4d45ee661456b3d170b051dcdf3beb402b5d19ab8ddcd85edf13c2d29a58b39aca7b29917bd146e21082ff580c5dfbe5e503c63997ec1a6c22d5b17061ff0da79ba641669e8ad5b3920d90e1b88ad0efb81c55c9c623f5bdb799e15bc2745abaa5dce257654b735a071e994e9770c75d1de8ebf0e2c49d484138c65774e3fde2ec1719aa688507879b7819fb61850d1f862f678b3b260304d13a831ca3eb0b10439f6bc3da70d6b361b8c7a03200077346cef85d43f29f286f902d99b5087255875bb728ec5def25af8e74e641a82862aac4645e98db604cef53302f6b71877ed9a1fc58bb6e364a4762b63e4b4b848b8e6ed09cfaf693e7daa0b1f7bdbd297f891c294b76a267b972c8b658ed6db2e6d2a3d64c91de4eb974be30e9a547576bc8db0df293b8480bb5467e9481251bfe0cf831c474e7dc157958afa463eb2e2b7ba6af9e46d853a1ad90677c78aa3f6c5eaee34eb3fdba3d51f042392188ed7899966f89b2f6a3735c0eea1fc957c2cf4c868612b18c9d838b93b058e0fbd48aa34a786b02c82516f0a099ae07cb682ebc05e5e86e531d7df4fdc16aca9af5c87a25042b7077d71d83dabc327e3195323eedc62580d6f9cde5da5cbef3039de47e8df9ee3f6716ad73c3edd47c299953bb8a8212003bc55b92f70feda73ed8c19400ba", 0xcc1}], 0x1, 0x0, 0x0, 0x800}], 0x1, 0x840) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r7, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8089}, 0x4000814) write$nci(r4, 0x0, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB="f4ff02"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)="3999084633cd5c5956b2fa44f1ff51fb31047c266a6fc96365cad1c5b70c61a76143fab3c2a8060e9f7e05ba7840c8a591ec083ff903d467bd82a0a3d1fb01837b7ccf5bc7de5fd1a1363d3f1d3a59a18534ee0fd0e7763edbe70e56fed6caa724e956f8c33f0c256e1cfa78f3f27c8569f98d51d0484658193a3f", 0x7b) program crashed: KASAN: global-out-of-bounds Read in uevent_store bisect: bisecting 24 programs bisect: split chunks (needed=false): <23> bisect: split chunk #0 of len 23 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 10, 2, 7, 6, 8, 30, 7, 17, 11, 10, 14, 5, 18, 4, 4] detailed listing: executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1802000083cd000000000000fdfffdff85000000cc00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000007ffec00b703000000000000850000007000004095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="440000000206030000000000000000000d0000000000020073797a320000000005005960f0032d00ed3610b0744059c6bb1a0400000000000900500073797a310000000005000500020000001c000100060000007b184a640459b3ffda548a178066c5d8777aa9e02387565a69478f656051f638be07e97b6384c94f9633a99e84f915f2458c9cdb658d00abc5568aeb01dc07804436dc1e631a4483738b543bdfe01eb169ed46a948d155805d9b24"], 0x2a}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000000000000000050000020500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x24000840}, 0x4800) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x10d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x6, 0x0, 0x0, 0x574aca18db6b83aa, 0x0, 0x0, 0x2}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x50, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_HANDLE_DFS={0x4}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffff7}], @NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x3}]}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x7}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x81}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40804}, 0x4040840) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x437, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50083, 0x2c01}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40850) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200) dup3(r1, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) executing program 0: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x2, &(0x7f0000000000)=@raw=[@call={0x85, 0x0, 0xd90f, 0x20}, @ldst={0x0, 0x1, 0x1, 0x8, 0x8, 0xfffffffffffffff8, 0xfffffffffffffffc}], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x50) socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r1, 0x84, 0x19, 0x0, 0x0) write$sysctl(r1, &(0x7f0000000100)='4\x00', 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="002145000b2c000b0000400600000a0000010a000002005000500000000200000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) (fail_nth: 3) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f00000008c0)={'sit0\x00', &(0x7f0000000880)={@empty, @broadcast, 0x1e, 0x12}}) creat(&(0x7f0000000280)='./file0\x00', 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x0, 0x0, 0x29, 0x0, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x40086603, &(0x7f0000000040)) mount$9p_virtio(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2000000, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=virtio,access=', @ANYRESDEC]) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000008c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000040)=0x40, 0x4) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) setsockopt$inet6_int(r3, 0x29, 0x42, &(0x7f0000000180)=0x5, 0x4) sendmmsg$inet6(r3, &(0x7f0000004cc0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000048c0)="04e9", 0x2}], 0x1}}], 0x1, 0x4000001) r4 = dup(r3) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, '\x00', "de0000006deed7f21d74bc440900", "9884f958", "fc4bd6b33a9b93ca"}, 0x28) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{0x7f, 0x9, 0xd5, 0x401}, {0x0, 0x6, 0x8, 0x3}, {0x5, 0x1, 0x9, 0x4}, {0x37c, 0x66, 0x6, 0x1ff}, {0x8, 0x8, 0x3, 0x5}, {0x6, 0x1, 0x80, 0x7}]}) r6 = syz_open_dev$hidraw(&(0x7f0000000280), 0x0, 0x2) write$hidraw(r6, &(0x7f0000000000)='\x00\x00', 0x2) close_range(r5, 0xffffffffffffffff, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000001080)='a', 0x1) mkdirat(r0, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x40480923, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='3\n', 0x2) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) executing program 1: r0 = syz_open_dev$I2C(&(0x7f00000002c0), 0x0, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000001380)={0x0, 0xc0, 0x5, &(0x7f0000000300)={0xc, "c8660972daadf38033035d21dcc910b0dbf5be74076dc3f2f67b364ef9ed965b13"}}) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = socket$packet(0x11, 0x2, 0x300) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010102d1a05e20cd0c02010e8901fc03010902120001085440010904"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) read(r2, 0x0, 0x0) (async) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r1, 0x0) (async) mremap(&(0x7f000000e000/0x7000)=nil, 0x7000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) (async) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200) dup3(r1, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @ioapic={0x26000, 0x80000000, 0x2, 0x30000, 0x0, [{0xd3, 0x4, 0x3, '\x00', 0xff}, {0x70, 0x66, 0x2, '\x00', 0x7}, {0x8, 0x6, 0x4, '\x00', 0x4}, {0x7a, 0xa, 0x8, '\x00', 0x3}, {0x9, 0x1, 0x0, '\x00', 0x4}, {0x7f, 0x6, 0x0, '\x00', 0x33}, {0x10, 0x81, 0x81, '\x00', 0x3}, {0x1, 0x1, 0x3, '\x00', 0x3}, {0x81, 0x7, 0x3, '\x00', 0x9}, {0x4, 0x9, 0x0, '\x00', 0x2}, {0x7, 0x7, 0x3, '\x00', 0x9}, {0x81, 0xff, 0x7e, '\x00', 0x4}, {0x0, 0x7, 0x4, '\x00', 0x7}, {0x9, 0x0, 0x7f, '\x00', 0xf}, {0x1, 0x5, 0x0, '\x00', 0x7f}, {0x40, 0xd, 0x1, '\x00', 0x6}, {0x0, 0x2, 0x3, '\x00', 0x9}, {0x18, 0x1, 0x8, '\x00', 0x8}, {0x60, 0x1, 0x2, '\x00', 0x8}, {0x40, 0x4, 0x4, '\x00', 0x9}, {0x2, 0x9, 0x81, '\x00', 0x4}, {0x1, 0x6, 0x1, '\x00', 0x8}, {0x7, 0xe2, 0x5, '\x00', 0xd}, {0x3, 0x0, 0x92, '\x00', 0xff}]}}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x368, 0x228, 0x2d0, 0xffffffff, 0xd8, 0x170, 0x2d0, 0x2d0, 0xffffffff, 0x2d0, 0x2d0, 0x5, 0x0, {[{{@ip={@rand_addr=0x640100fc, @rand_addr=0x64010101, 0xff, 0x0, 'veth1_macvtap\x00', 'ipvlan1\x00', {0xff}, {}, 0x33, 0x2, 0x14}, 0x0, 0xa0, 0xd8, 0x48, {}, [@common=@ah={{0x30}, {[0x1, 0x3], 0xff}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x67, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @empty, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @gre_key=0xe, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x200, 0x248, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r0 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) fsmount(0xffffffffffffffff, 0x1, 0xa) write$hidraw(r0, 0x0, 0xfffffd74) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000300)={0x0, 0x30000, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x840) executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x700, 0x0, 0xfffffffffffffffa, 0x0, 0xfffffffffffffffd}, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f00000042c0)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000340)="1e8395e2bd0d152628c70305dc1d683bba23ac1353f39f6c1d1ebdeb81ac6b0b1b6d21098503a16294770cec5e5dabf9645f63b09f7d700b7ea791ddc83f242125fcc466efccd7d3b7f428488301ed8885fb2f74baba39043d7c2195ead98b9c2b7e7402771164ba1b91e1bf60b2d68b4f16b6d8163c62e3981d6b1c713fbb39fd0f5fad509a225d1c97798ba92d471ac3ee4fa61b42f670e7fb6b87e5e2ece519d623f156e6475fb773dd9ca9bb2482c5d1a05e66bab288d99ec1db3f1cf3fafe5c17dd51371596371a40ef9245c4959416e87865375f4a947b1e64395600a101503f6a7da4229c65264115f0a4136d271abb5c1d0958e8ba9ff721dc800d9d1c15ee3af05478431867addab50a9f374b57fa450751c06a69a2eb9830b7aef3004bfdc92a6944885db52dac9c3c57a8f132621ef46308c3fc3b9cb93410a34fa959dde11d8bca0ee6a79bed302acc5666e6cdbccfdef977798e844b2fda3246e4b9ab3e3be51ef08dd3c51070e0cd965124bc9663faceebb3e878358c5de8a1510c8754e7cdaf2f2d6a0b8862d83a9cd57141deb0057c26544083fa1acf6abc25cb8ccdd15e7fb85a22791d538a8bcd45811466a3e460e70325f5e4ef4ba2f749bcaba2d9d3bc8de5d23879fb70bc258fa67268cbb27c60279055f8c3bb8869c22696d6ee1ef3fccaddda098fda773afddc02c8a5c4d1b89d85326233689dfb2c456b4a5b7f0fba2763d452d3abcb028122263342a66993db2391e26217d71dcab7f71bc7b35fefa4db0dea72aaa5f8edffd4ddb2c8e5c2243bccec57d133530617886bd1f0c981a921c66ed8c3dd4f39577fa782ac66fcde68ad2d86b6c6ead9fbc98acae404223e7d9461689816ec6990ccff32db513c0e4abe46bcdcebe804722e4299045c6263c0d4d79237564c01b5bd27d157d82ed7be47d4c786fa609899d830aa88d8341a7c8906fc0857f0b8553f47880b63bc357bb864f6df27b74bba838b78089f7c78e5e45597c6d7f10e0095c2df3cb654aa51efaab8b7a9b935ee54c302ed0f98f8a01cfe250bd54b5812ccb118e48edaf83664bfec7cbf911121cd58aeed23892c7a21db1d57eb62cccca4d1040e07e859e93f146ec6a5c95e99ff786b573da0ad1b13232727ac6b33b32f5d5226fdf36bc23f4741724ba6482c695281d5644be86550bc916a3f5a6ec274a57429d98421a042a2eee561fa64279270fbfaf07e638b43623726ed1242d341d1dc8a4f6ec52915c518178b1638675af7687763aff23cf75b831484dd1a669022a5a2c8599dff7909e7368700a6de96dbb39c65bfd572ac78fe93dc61466556a70fa4ff52c39fc8b9e12e4e3ca964937a2ca7fbf08ffa8b2844c47678dc0850e68646f35364f11b71b27f6729fe96547c8f8e6ce4beb6d95283f3537f2b76cd05c97f1364d87b9a36ce8fc7fb16e5df9d10979de8fd7153b84a784905122587713d0fd527ae215f1127bf4f351f786e7da4c19bedbb92633b842bec3570d102ca2ae7b764310314d6deaf916e91ca891e7b4622c7d045cccf21b9ac49834bf50f16538d02d11ac784252e656b9fda0ccf2583e401e8f6f2164ebae8e21c8b5bd417658ecca2f56ea57a0f44b8c93aee09843b79f449d214876fbd1078160c450dbf4e3988eabe294e2cb6688af4a2d162136e24727a646d52cdc585c1582686198819984327839f332fc57eb65d0ff0208c14c73ecf57003151f71bb7cc7663c6557ee30a3b4d40480530ac7aea0b4aeaebe2a9561339c8aea909cc68debcbd26d368bd43a2068ba0d97d54ec1903a7788da2b42ee16182973e25808050552c67a97354d264b5d64a97713095bf96b10079dd8b4d0c9376f6d7feb15d35b43a4eb95b15463faa3c1cf32de42124c49504b83a80b0044d0239e1b4fae9805e7ca2030a211bfd3505b94be04abe6a50a4a3fd39dcba7cf2f6e5db1191323743ab11de2d6c3eea280a61dcf483477c1c04c62b54053be8b51995cd267a786bf997412f812fe4b7891955f9bb6458a5805fc6e2239a22ee3b7bbab96b10d64d6848468cedf34512bd075c372ebfeae9ea9782147997fccf6ae6d7591cd8c1899fe1ccaadc828c68e41c1949dc0d531f266dcc3db92dd64633a9c35c890dc7e17b2eef8cb33b47558d42b0e4310a7247759870c2392792b64e7e8a34b6de9b516fabb61d8cf477cea91a63c68d6229e4e4d0580ea464e3cdf0de1a0f0ee90d9d107c37476c30ef3f270429763f28aff38931cadd263fd3fd18fcbf1046ac1097f2c95e84cc9e582c9f84d0c9a9b011ce60fc8d39a0f21f8d51ed4f3195e65de3f2c1e1b2d2608bdbdc041ea42a46b1aaa6c150d27a1a27d04e638e8cc92af3187ee72eade3b8373ffc8bf8445e940c43f51713875248002a84583a0ea604e7a49a90751970266b3cb6bfa0e91ed6afb059386eca70eedb3c05d355161f11dc7644beaee7a2453af13d1060e69ed5a2fb77a8650824d0cb5e7c6b8cd75955246064332d1a774218946f82d57ac514026ab2dd425eb026b6abc3df0f756af26299cd8e20895b7c4f155581ad4fb36c3cab418f37cae4cac3cfcfdb6c5ae1452ea047ab26d6f2aea0310d38e34bbb88d418e7fa681af0c3442907d6ae3342a7066cb1b004339a69e2da89b9d53d6433c6133e6b560038fa7fbaae36c3f649290166fbc8a5018e7357d5639c85c1612aa5f395f23abe3e206d1e51d2db1c55887c65e5f47aace8c159d20c6a57bc71ea4eb7ae839f682d93bd8441366dac3f48156bbf971b1da96d46352f3da31b59646e38483e8daff62aa25e339b9bb27a500ef35c6b169b37aed9044666b04a9a668df87a0aea02edde2eef0ad2dd866117419b93b9d7e63709885478d165473bb2fba5bf2b1651b59930530f2a3b418a9b616bb3f9692f51f63873b31f173d3555db4d304fa39a21574cb9fb2cdbca2874f5db8c0e3a134c7132a8ece82448683564550e14e9e004c8f5d3dbd1956d5983694f47d6861c563819d16bb7bae03db5ef7b0421723d5a2c1f305913ee8c1cff8435bff588e2f4b0c929d512fc5058730de63753d64965714047b37eab93ab6fc7b570cd3aa7ef2e5f95237b481a44057c0697b0d1a1ecbcbe72cecc7a9e69818140810c086c0786c05c081100165d501775674cd1bc10c8fa97237e6e3901b64861f92af1601081057f62513fc5f82cfbb5b4ad3e90b65e7f2767d5f379748d7f0ce0a9b8cdbb241d2a7b03173c1b6e5a36b3a6412a2f38330cadb3e00b4c235696353545867720d6e713b01359183a4cbba321c4da1d2d323d470836374e11cb200bde3645df5b4989c95b137aa0ca706d83f1175ee418d0ae1379c07e9d8d96c9883b2e60221d5d6556b04b5b825bee1c2d893537420ce4dcb17b2c25d29f4ebc0925abcdbaa94275b20762a2f858aac6c4f6c06dadb8809805416cde95861455915e2ac9f806a34e8097c9671b7f88afb0d8e72b6b3357666bd1ae8bc24b722db69be36c0bce96472ca40adfd12f95c0abd70c406787416e92cb07493f5eb7123d0c4d5f2f689d5e34a840d063a7a9dd5334e92f807d9f57513e6e954e7492e1a92f5a265110308c92bf926463c3452d8f8012e56178a85e60e8af568430d919cdcec4ea98756d624951ce3970bb5b9fd4c3e43bb11a7e0982ae628eaa272da927babdfb88f63179a4f752d09ddc0a462af6e123240e4b545ca7e27491e16603275ad84f676c6c488079c1fc30993256f59f8ce4fa53706c8f91f2d6f6e3c7a11696b8862e7a8097fcc8b9627aaeec7e0cadbfcd2506633da28dd28b17ed3336d5ff0a0cdedf606d812a8ad514fadb22697a3e2f92edda7e20160522ea85cfcf8636f43e638504c31e25b1eb40b1c6764f29d93e982affef5a1b3027de566554b634ba01f130b116808f1c5fbd4d45ee661456b3d170b051dcdf3beb402b5d19ab8ddcd85edf13c2d29a58b39aca7b29917bd146e21082ff580c5dfbe5e503c63997ec1a6c22d5b17061ff0da79ba641669e8ad5b3920d90e1b88ad0efb81c55c9c623f5bdb799e15bc2745abaa5dce257654b735a071e994e9770c75d1de8ebf0e2c49d484138c65774e3fde2ec1719aa688507879b7819fb61850d1f862f678b3b260304d13a831ca3eb0b10439f6bc3da70d6b361b8c7a03200077346cef85d43f29f286f902d99b5087255875bb728ec5def25af8e74e641a82862aac4645e98db604cef53302f6b71877ed9a1fc58bb6e364a4762b63e4b4b848b8e6ed09cfaf693e7daa0b1f7bdbd297f891c294b76a267b972c8b658ed6db2e6d2a3d64c91de4eb974be30e9a547576bc8db0df293b8480bb5467e9481251bfe0cf831c474e7dc157958afa463eb2e2b7ba6af9e46d853a1ad90677c78aa3f6c5eaee34eb3fdba3d51f042392188ed7899966f89b2f6a3735c0eea1fc957c2cf4c868612b18c9d838b93b058e0fbd48aa34a786b02c82516f0a099ae07cb682ebc05e5e86e531d7df4fdc16aca9af5c87a25042b7077d71d83dabc327e3195323eedc62580d6f9cde5da5cbef3039de47e8df9ee3f6716ad73c3edd47c299953bb8a8212003bc55b92f70feda73ed8c19400ba", 0xcc1}], 0x1, 0x0, 0x0, 0x800}], 0x1, 0x840) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r7, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8089}, 0x4000814) write$nci(r4, 0x0, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB="f4ff02"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)="3999084633cd5c5956b2fa44f1ff51fb31047c266a6fc96365cad1c5b70c61a76143fab3c2a8060e9f7e05ba7840c8a591ec083ff903d467bd82a0a3d1fb01837b7ccf5bc7de5fd1a1363d3f1d3a59a18534ee0fd0e7763edbe70e56fed6caa724e956f8c33f0c256e1cfa78f3f27c8569f98d51d0484658193a3f", 0x7b) program crashed: KASAN: global-out-of-bounds Read in uevent_store bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 11, 10, 14, 5, 18, 4, 4] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) executing program 1: r0 = syz_open_dev$I2C(&(0x7f00000002c0), 0x0, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000001380)={0x0, 0xc0, 0x5, &(0x7f0000000300)={0xc, "c8660972daadf38033035d21dcc910b0dbf5be74076dc3f2f67b364ef9ed965b13"}}) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = socket$packet(0x11, 0x2, 0x300) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010102d1a05e20cd0c02010e8901fc03010902120001085440010904"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) read(r2, 0x0, 0x0) (async) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r1, 0x0) (async) mremap(&(0x7f000000e000/0x7000)=nil, 0x7000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) (async) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200) dup3(r1, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) executing program 1: openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @ioapic={0x26000, 0x80000000, 0x2, 0x30000, 0x0, [{0xd3, 0x4, 0x3, '\x00', 0xff}, {0x70, 0x66, 0x2, '\x00', 0x7}, {0x8, 0x6, 0x4, '\x00', 0x4}, {0x7a, 0xa, 0x8, '\x00', 0x3}, {0x9, 0x1, 0x0, '\x00', 0x4}, {0x7f, 0x6, 0x0, '\x00', 0x33}, {0x10, 0x81, 0x81, '\x00', 0x3}, {0x1, 0x1, 0x3, '\x00', 0x3}, {0x81, 0x7, 0x3, '\x00', 0x9}, {0x4, 0x9, 0x0, '\x00', 0x2}, {0x7, 0x7, 0x3, '\x00', 0x9}, {0x81, 0xff, 0x7e, '\x00', 0x4}, {0x0, 0x7, 0x4, '\x00', 0x7}, {0x9, 0x0, 0x7f, '\x00', 0xf}, {0x1, 0x5, 0x0, '\x00', 0x7f}, {0x40, 0xd, 0x1, '\x00', 0x6}, {0x0, 0x2, 0x3, '\x00', 0x9}, {0x18, 0x1, 0x8, '\x00', 0x8}, {0x60, 0x1, 0x2, '\x00', 0x8}, {0x40, 0x4, 0x4, '\x00', 0x9}, {0x2, 0x9, 0x81, '\x00', 0x4}, {0x1, 0x6, 0x1, '\x00', 0x8}, {0x7, 0xe2, 0x5, '\x00', 0xd}, {0x3, 0x0, 0x92, '\x00', 0xff}]}}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x368, 0x228, 0x2d0, 0xffffffff, 0xd8, 0x170, 0x2d0, 0x2d0, 0xffffffff, 0x2d0, 0x2d0, 0x5, 0x0, {[{{@ip={@rand_addr=0x640100fc, @rand_addr=0x64010101, 0xff, 0x0, 'veth1_macvtap\x00', 'ipvlan1\x00', {0xff}, {}, 0x33, 0x2, 0x14}, 0x0, 0xa0, 0xd8, 0x48, {}, [@common=@ah={{0x30}, {[0x1, 0x3], 0xff}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x67, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @empty, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @gre_key=0xe, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x619}, 0x38) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x88000}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x200, 0x248, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r0 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) fsmount(0xffffffffffffffff, 0x1, 0xa) write$hidraw(r0, 0x0, 0xfffffd74) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000300)={0x0, 0x30000, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x840) executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x700, 0x0, 0xfffffffffffffffa, 0x0, 0xfffffffffffffffd}, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) bind$alg(r1, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f00000042c0)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000340)="1e8395e2bd0d152628c70305dc1d683bba23ac1353f39f6c1d1ebdeb81ac6b0b1b6d21098503a16294770cec5e5dabf9645f63b09f7d700b7ea791ddc83f242125fcc466efccd7d3b7f428488301ed8885fb2f74baba39043d7c2195ead98b9c2b7e7402771164ba1b91e1bf60b2d68b4f16b6d8163c62e3981d6b1c713fbb39fd0f5fad509a225d1c97798ba92d471ac3ee4fa61b42f670e7fb6b87e5e2ece519d623f156e6475fb773dd9ca9bb2482c5d1a05e66bab288d99ec1db3f1cf3fafe5c17dd51371596371a40ef9245c4959416e87865375f4a947b1e64395600a101503f6a7da4229c65264115f0a4136d271abb5c1d0958e8ba9ff721dc800d9d1c15ee3af05478431867addab50a9f374b57fa450751c06a69a2eb9830b7aef3004bfdc92a6944885db52dac9c3c57a8f132621ef46308c3fc3b9cb93410a34fa959dde11d8bca0ee6a79bed302acc5666e6cdbccfdef977798e844b2fda3246e4b9ab3e3be51ef08dd3c51070e0cd965124bc9663faceebb3e878358c5de8a1510c8754e7cdaf2f2d6a0b8862d83a9cd57141deb0057c26544083fa1acf6abc25cb8ccdd15e7fb85a22791d538a8bcd45811466a3e460e70325f5e4ef4ba2f749bcaba2d9d3bc8de5d23879fb70bc258fa67268cbb27c60279055f8c3bb8869c22696d6ee1ef3fccaddda098fda773afddc02c8a5c4d1b89d85326233689dfb2c456b4a5b7f0fba2763d452d3abcb028122263342a66993db2391e26217d71dcab7f71bc7b35fefa4db0dea72aaa5f8edffd4ddb2c8e5c2243bccec57d133530617886bd1f0c981a921c66ed8c3dd4f39577fa782ac66fcde68ad2d86b6c6ead9fbc98acae404223e7d9461689816ec6990ccff32db513c0e4abe46bcdcebe804722e4299045c6263c0d4d79237564c01b5bd27d157d82ed7be47d4c786fa609899d830aa88d8341a7c8906fc0857f0b8553f47880b63bc357bb864f6df27b74bba838b78089f7c78e5e45597c6d7f10e0095c2df3cb654aa51efaab8b7a9b935ee54c302ed0f98f8a01cfe250bd54b5812ccb118e48edaf83664bfec7cbf911121cd58aeed23892c7a21db1d57eb62cccca4d1040e07e859e93f146ec6a5c95e99ff786b573da0ad1b13232727ac6b33b32f5d5226fdf36bc23f4741724ba6482c695281d5644be86550bc916a3f5a6ec274a57429d98421a042a2eee561fa64279270fbfaf07e638b43623726ed1242d341d1dc8a4f6ec52915c518178b1638675af7687763aff23cf75b831484dd1a669022a5a2c8599dff7909e7368700a6de96dbb39c65bfd572ac78fe93dc61466556a70fa4ff52c39fc8b9e12e4e3ca964937a2ca7fbf08ffa8b2844c47678dc0850e68646f35364f11b71b27f6729fe96547c8f8e6ce4beb6d95283f3537f2b76cd05c97f1364d87b9a36ce8fc7fb16e5df9d10979de8fd7153b84a784905122587713d0fd527ae215f1127bf4f351f786e7da4c19bedbb92633b842bec3570d102ca2ae7b764310314d6deaf916e91ca891e7b4622c7d045cccf21b9ac49834bf50f16538d02d11ac784252e656b9fda0ccf2583e401e8f6f2164ebae8e21c8b5bd417658ecca2f56ea57a0f44b8c93aee09843b79f449d214876fbd1078160c450dbf4e3988eabe294e2cb6688af4a2d162136e24727a646d52cdc585c1582686198819984327839f332fc57eb65d0ff0208c14c73ecf57003151f71bb7cc7663c6557ee30a3b4d40480530ac7aea0b4aeaebe2a9561339c8aea909cc68debcbd26d368bd43a2068ba0d97d54ec1903a7788da2b42ee16182973e25808050552c67a97354d264b5d64a97713095bf96b10079dd8b4d0c9376f6d7feb15d35b43a4eb95b15463faa3c1cf32de42124c49504b83a80b0044d0239e1b4fae9805e7ca2030a211bfd3505b94be04abe6a50a4a3fd39dcba7cf2f6e5db1191323743ab11de2d6c3eea280a61dcf483477c1c04c62b54053be8b51995cd267a786bf997412f812fe4b7891955f9bb6458a5805fc6e2239a22ee3b7bbab96b10d64d6848468cedf34512bd075c372ebfeae9ea9782147997fccf6ae6d7591cd8c1899fe1ccaadc828c68e41c1949dc0d531f266dcc3db92dd64633a9c35c890dc7e17b2eef8cb33b47558d42b0e4310a7247759870c2392792b64e7e8a34b6de9b516fabb61d8cf477cea91a63c68d6229e4e4d0580ea464e3cdf0de1a0f0ee90d9d107c37476c30ef3f270429763f28aff38931cadd263fd3fd18fcbf1046ac1097f2c95e84cc9e582c9f84d0c9a9b011ce60fc8d39a0f21f8d51ed4f3195e65de3f2c1e1b2d2608bdbdc041ea42a46b1aaa6c150d27a1a27d04e638e8cc92af3187ee72eade3b8373ffc8bf8445e940c43f51713875248002a84583a0ea604e7a49a90751970266b3cb6bfa0e91ed6afb059386eca70eedb3c05d355161f11dc7644beaee7a2453af13d1060e69ed5a2fb77a8650824d0cb5e7c6b8cd75955246064332d1a774218946f82d57ac514026ab2dd425eb026b6abc3df0f756af26299cd8e20895b7c4f155581ad4fb36c3cab418f37cae4cac3cfcfdb6c5ae1452ea047ab26d6f2aea0310d38e34bbb88d418e7fa681af0c3442907d6ae3342a7066cb1b004339a69e2da89b9d53d6433c6133e6b560038fa7fbaae36c3f649290166fbc8a5018e7357d5639c85c1612aa5f395f23abe3e206d1e51d2db1c55887c65e5f47aace8c159d20c6a57bc71ea4eb7ae839f682d93bd8441366dac3f48156bbf971b1da96d46352f3da31b59646e38483e8daff62aa25e339b9bb27a500ef35c6b169b37aed9044666b04a9a668df87a0aea02edde2eef0ad2dd866117419b93b9d7e63709885478d165473bb2fba5bf2b1651b59930530f2a3b418a9b616bb3f9692f51f63873b31f173d3555db4d304fa39a21574cb9fb2cdbca2874f5db8c0e3a134c7132a8ece82448683564550e14e9e004c8f5d3dbd1956d5983694f47d6861c563819d16bb7bae03db5ef7b0421723d5a2c1f305913ee8c1cff8435bff588e2f4b0c929d512fc5058730de63753d64965714047b37eab93ab6fc7b570cd3aa7ef2e5f95237b481a44057c0697b0d1a1ecbcbe72cecc7a9e69818140810c086c0786c05c081100165d501775674cd1bc10c8fa97237e6e3901b64861f92af1601081057f62513fc5f82cfbb5b4ad3e90b65e7f2767d5f379748d7f0ce0a9b8cdbb241d2a7b03173c1b6e5a36b3a6412a2f38330cadb3e00b4c235696353545867720d6e713b01359183a4cbba321c4da1d2d323d470836374e11cb200bde3645df5b4989c95b137aa0ca706d83f1175ee418d0ae1379c07e9d8d96c9883b2e60221d5d6556b04b5b825bee1c2d893537420ce4dcb17b2c25d29f4ebc0925abcdbaa94275b20762a2f858aac6c4f6c06dadb8809805416cde95861455915e2ac9f806a34e8097c9671b7f88afb0d8e72b6b3357666bd1ae8bc24b722db69be36c0bce96472ca40adfd12f95c0abd70c406787416e92cb07493f5eb7123d0c4d5f2f689d5e34a840d063a7a9dd5334e92f807d9f57513e6e954e7492e1a92f5a265110308c92bf926463c3452d8f8012e56178a85e60e8af568430d919cdcec4ea98756d624951ce3970bb5b9fd4c3e43bb11a7e0982ae628eaa272da927babdfb88f63179a4f752d09ddc0a462af6e123240e4b545ca7e27491e16603275ad84f676c6c488079c1fc30993256f59f8ce4fa53706c8f91f2d6f6e3c7a11696b8862e7a8097fcc8b9627aaeec7e0cadbfcd2506633da28dd28b17ed3336d5ff0a0cdedf606d812a8ad514fadb22697a3e2f92edda7e20160522ea85cfcf8636f43e638504c31e25b1eb40b1c6764f29d93e982affef5a1b3027de566554b634ba01f130b116808f1c5fbd4d45ee661456b3d170b051dcdf3beb402b5d19ab8ddcd85edf13c2d29a58b39aca7b29917bd146e21082ff580c5dfbe5e503c63997ec1a6c22d5b17061ff0da79ba641669e8ad5b3920d90e1b88ad0efb81c55c9c623f5bdb799e15bc2745abaa5dce257654b735a071e994e9770c75d1de8ebf0e2c49d484138c65774e3fde2ec1719aa688507879b7819fb61850d1f862f678b3b260304d13a831ca3eb0b10439f6bc3da70d6b361b8c7a03200077346cef85d43f29f286f902d99b5087255875bb728ec5def25af8e74e641a82862aac4645e98db604cef53302f6b71877ed9a1fc58bb6e364a4762b63e4b4b848b8e6ed09cfaf693e7daa0b1f7bdbd297f891c294b76a267b972c8b658ed6db2e6d2a3d64c91de4eb974be30e9a547576bc8db0df293b8480bb5467e9481251bfe0cf831c474e7dc157958afa463eb2e2b7ba6af9e46d853a1ad90677c78aa3f6c5eaee34eb3fdba3d51f042392188ed7899966f89b2f6a3735c0eea1fc957c2cf4c868612b18c9d838b93b058e0fbd48aa34a786b02c82516f0a099ae07cb682ebc05e5e86e531d7df4fdc16aca9af5c87a25042b7077d71d83dabc327e3195323eedc62580d6f9cde5da5cbef3039de47e8df9ee3f6716ad73c3edd47c299953bb8a8212003bc55b92f70feda73ed8c19400ba", 0xcc1}], 0x1, 0x0, 0x0, 0x800}], 0x1, 0x840) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r7, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8089}, 0x4000814) write$nci(r4, 0x0, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB="f4ff02"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)="3999084633cd5c5956b2fa44f1ff51fb31047c266a6fc96365cad1c5b70c61a76143fab3c2a8060e9f7e05ba7840c8a591ec083ff903d467bd82a0a3d1fb01837b7ccf5bc7de5fd1a1363d3f1d3a59a18534ee0fd0e7763edbe70e56fed6caa724e956f8c33f0c256e1cfa78f3f27c8569f98d51d0484658193a3f", 0x7b) program crashed: KASAN: global-out-of-bounds Read in uevent_store bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store bisect: the chunk can be dropped bisect: 1 programs left: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store bisect: concatenation succeeded found reproducer with 4 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash simplifying guilty program options testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb-conn-gpio/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add', 0x3f) program crashed: KASAN: global-out-of-bounds Read in uevent_store validation run: crashed=true reproducing took 18m19.602133205s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline] BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200 Read of size 1 at addr ffffffff8d7101be by task syz.0.17/5911 CPU: 2 UID: 0 PID: 5911 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 kobject_action_type lib/kobject_uevent.c:86 [inline] kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200 uevent_store+0x46/0x90 drivers/base/bus.c:723 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd13c39e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcffccc9c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fd13c625fa0 RCX: 00007fd13c39e0d9 RDX: 000000000000003f RSI: 0000200000000300 RDI: 0000000000000003 RBP: 00007fd13c435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd13c625fac R14: 00007fd13c625fa0 R15: 00007fd13c625fa0 The buggy address belongs to the variable: uevent_helper_sysctl_table+0xde/0x2a0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xd710 flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000002000 ffffea000035c408 ffffea000035c408 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffffffff8d710080: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 ffffffff8d710100: 00 00 00 f9 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 >ffffffff8d710180: 04 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9 ^ ffffffff8d710200: 07 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 ffffffff8d710280: 07 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline] BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200 Read of size 1 at addr ffffffff8d7101be by task syz.0.17/5911 CPU: 2 UID: 0 PID: 5911 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 kobject_action_type lib/kobject_uevent.c:86 [inline] kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200 uevent_store+0x46/0x90 drivers/base/bus.c:723 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd13c39e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcffccc9c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fd13c625fa0 RCX: 00007fd13c39e0d9 RDX: 000000000000003f RSI: 0000200000000300 RDI: 0000000000000003 RBP: 00007fd13c435024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd13c625fac R14: 00007fd13c625fa0 R15: 00007fd13c625fa0 The buggy address belongs to the variable: uevent_helper_sysctl_table+0xde/0x2a0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xd710 flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000002000 ffffea000035c408 ffffea000035c408 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffffffff8d710080: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 ffffffff8d710100: 00 00 00 f9 f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 >ffffffff8d710180: 04 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9 ^ ffffffff8d710200: 07 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 ffffffff8d710280: 07 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ==================================================================