Extracting prog: 53m15.02258627s
Minimizing prog: 28m36.85682794s
Simplifying prog options: 0s
Extracting C: 40.274453929s
Simplifying C: 8m35.269954265s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io$sierra_net-syz_usb_control_io$uac1-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$l2tp6-socket$inet6_tcp-syz_usb_connect-syz_open_dev$audion-write$P9_RVERSION-close_range
detailed listing:
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$procfs-open-flock-open-flock-preadv
detailed listing:
executing program 0:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 2:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000071000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c00018008000100070001000c0002"], 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r1, 0xfffffffb)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @random="246fd483a581", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x14, 0x6, 0x0, @remote={0xfe, 0x50}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x6, 0x4, 0x4, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r2}, 0xc)
executing program 2:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0xa42)
r0 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00')
r1 = epoll_create1(0x0)
syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000004c0)={0x6000000d})
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 2:
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24000000)
r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000a80)={[{@auto_da_alloc}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000700)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a})
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4)
connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e24, @remote}, 0x10)
timer_create(0x0, &(0x7f0000000380)={0x0, 0x11, 0x800000000004}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4)
sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="89", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="a9", 0x1}], 0x20c}}], 0x2, 0x4000045)
executing program 1:
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x80881000, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, 0x0, 0x0}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000002b40)={r1, 0x0, 0x0}, 0x20)
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)

program did not crash
bisect: split chunks (needed=true): <8>, <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: split chunk #1 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})

program did not crash
bisect: split chunks (needed=true): <4>, <4>, <4>, <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: split chunk #2 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: split chunk #3 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)

program did not crash
bisect: too many guilty chunks, aborting
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io$sierra_net-syz_usb_control_io$uac1-syz_open_dev$dvb_frontend
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$l2tp6-socket$inet6_tcp-syz_usb_connect-syz_open_dev$audion-write$P9_RVERSION-close_range
detailed listing:
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$procfs-open-flock-open-flock-preadv
detailed listing:
executing program 0:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 1m40s
testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 2:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000071000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c00018008000100070001000c0002"], 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r1, 0xfffffffb)
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @random="246fd483a581", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x14, 0x6, 0x0, @remote={0xfe, 0x50}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0)
executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x6, 0x4, 0x4, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r2}, 0xc)
executing program 2:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0xa42)
r0 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00')
r1 = epoll_create1(0x0)
syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000004c0)={0x6000000d})
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 2:
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24000000)
r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000a80)={[{@auto_da_alloc}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000700)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a})
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4)
connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e24, @remote}, 0x10)
timer_create(0x0, &(0x7f0000000380)={0x0, 0x11, 0x800000000004}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4)
sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="89", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="a9", 0x1}], 0x20c}}], 0x2, 0x4000045)
executing program 1:
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_clone(0x80881000, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, 0x0, 0x0}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000002b40)={r1, 0x0, 0x0}, 0x20)
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"})
executing program 1:
r0 = fanotify_init(0x40, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97)
fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 3:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80)
pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0)
sendfile(r1, r1, 0x0, 0x7a680000)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980))
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
executing program 2:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0)
flock(r1, 0x2)
r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2)
flock(r2, 0x1)
preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0)
executing program 0:
socket$l2tp6(0xa, 0x2, 0x73)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1)
write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
executing program 1:
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
pipe2$9p(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}})
ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000)
executing program 1:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6]
detailed listing:
executing program 3:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68)
r0 = userfaultfd(0x801)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040))
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000})
executing program 3:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)})
mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0)
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 2:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: concatenation succeeded
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=1m29.168011646s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
simplifying C reproducer
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program did not crash
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
testing program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
testing program (duration=1m29.168011646s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
reproducing took 1h36m16.771965455s
repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:3414
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
1 lock held by swapper/1/0:
 #0: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
 start_flush_work kernel/workqueue.c:3414 [inline]
 __flush_work+0x10f/0xac0 kernel/workqueue.c:3474
 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562
 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:694
 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x570/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: 99 17 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d d3 38 35 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c6
RAX: 952d77f494b01e00 RBX: ffffffff81631f44 RCX: 952d77f494b01e00
RDX: 0000000000000001 RSI: ffffffff8acacfe0 RDI: ffffffff8b1d5160
RBP: ffffc90000187f20 R08: ffff8880b8d36b6b R09: 1ffff110171a6d6d
R10: dffffc0000000000 R11: ffffed10171a6d6e R12: 1ffff92000030fc8
R13: dffffc0000000000 R14: 1ffff110039c8780 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:178 [inline]
 do_idle+0x334/0x5c0 kernel/sched/idle.c:302
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
 start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>
ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc90000180000, but annotated.

======================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	02 c3                	add    %bl,%al
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	f3 0f 1e fa          	endbr64
   d:	0f 0b                	ud2
   f:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  16:	00 00 00
  19:	f3 0f 1e fa          	endbr64
  1d:	66 90                	xchg   %ax,%ax
  1f:	0f 00 2d d3 38 35 00 	verw   0x3538d3(%rip)        # 0x3538f9
  26:	fb                   	sti
  27:	f4                   	hlt
* 28:	c3                   	ret <-- trapping instruction
  29:	66 0f 1f 00          	nopw   (%rax)
  2d:	55                   	push   %rbp
  2e:	41 57                	push   %r15
  30:	41 56                	push   %r14
  32:	41 54                	push   %r12
  34:	53                   	push   %rbx
  35:	50                   	push   %rax
  36:	8b 2f                	mov    (%rdi),%ebp
  38:	eb 2c                	jmp    0x66
  3a:	89 cb                	mov    %ecx,%ebx
  3c:	80                   	.byte 0x80
  3d:	f9                   	stc

final repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:3414
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
1 lock held by swapper/1/0:
 #0: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
 start_flush_work kernel/workqueue.c:3414 [inline]
 __flush_work+0x10f/0xac0 kernel/workqueue.c:3474
 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562
 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:694
 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x570/0x810 kernel/time/timer.c:2023
 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: 99 17 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d d3 38 35 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c6
RAX: 952d77f494b01e00 RBX: ffffffff81631f44 RCX: 952d77f494b01e00
RDX: 0000000000000001 RSI: ffffffff8acacfe0 RDI: ffffffff8b1d5160
RBP: ffffc90000187f20 R08: ffff8880b8d36b6b R09: 1ffff110171a6d6d
R10: dffffc0000000000 R11: ffffed10171a6d6e R12: 1ffff92000030fc8
R13: dffffc0000000000 R14: 1ffff110039c8780 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:178 [inline]
 do_idle+0x334/0x5c0 kernel/sched/idle.c:302
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
 start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>
ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc90000180000, but annotated.

======================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	02 c3                	add    %bl,%al
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	f3 0f 1e fa          	endbr64
   d:	0f 0b                	ud2
   f:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  16:	00 00 00
  19:	f3 0f 1e fa          	endbr64
  1d:	66 90                	xchg   %ax,%ax
  1f:	0f 00 2d d3 38 35 00 	verw   0x3538d3(%rip)        # 0x3538f9
  26:	fb                   	sti
  27:	f4                   	hlt
* 28:	c3                   	ret <-- trapping instruction
  29:	66 0f 1f 00          	nopw   (%rax)
  2d:	55                   	push   %rbp
  2e:	41 57                	push   %r15
  30:	41 56                	push   %r14
  32:	41 54                	push   %r12
  34:	53                   	push   %rbx
  35:	50                   	push   %rax
  36:	8b 2f                	mov    (%rdi),%ebp
  38:	eb 2c                	jmp    0x66
  3a:	89 cb                	mov    %ecx,%ebx
  3c:	80                   	.byte 0x80
  3d:	f9                   	stc