Extracting prog: 4m54.12975993s Minimizing prog: 1h18m6.576769361s Simplifying prog options: 0s Extracting C: 2m52.463488049s Simplifying C: 9m22.870172397s extracting reproducer from 37 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-mkdirat$cgroup_root-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched-sendmsg$ETHTOOL_MSG_FEATURES_SET detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x1) program did not crash single: failed to extract reproducer bisect: bisecting 37 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 26, 27, 28, 23, 28, 28, 30, 26, 30, 26, 26, 30, 26, 30, 30, 30, 28, 26, 30, 30, 26, 30, 30, 30, 28, 30, 30, 26, 26, 30, 26, 30, 30, 30, 30, 26] detailed listing: executing program 0: unshare(0x22020400) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r3, 0x80106f53, &(0x7f00000002c0)={0x4, &(0x7f00000000c0)=[{0x38, '\x00', @st={0x4, [{0x1, @svalue=0x3}, {0x3}, {0x0, @uvalue=0x1}, {0x0, @uvalue=0xa182}]}, 0x3}, {0x12, '\x00', @st={0x4, [{0x1, @svalue=0x4}, {0x1, @svalue=0x400}, {0x3, @uvalue=0x40000}, {0x1, @uvalue=0x41}]}, 0xfff}, {0x39, '\x00', @buffer={"cd5a585529647c60c5ccc64aca130e0f968982e34913b76bd9482a68561e7b05", 0x20}, 0x5}, {0x46, '\x00', @data=0x2, 0x45}]}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000001600d16f000000000000df251c7c00000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x4048015}, 0x10) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0xc8000, 0x0) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f0000000400)={0x53, 0x2, 0x1, {0xc, 0x6}, {0x9, 0x66a}, @period={0x5c, 0x7, 0x9, 0x3, 0x6, {0x8, 0x9, 0x8, 0x8}, 0x1, &(0x7f0000000280)=[0x401]}}) r5 = syz_open_dev$loop(&(0x7f0000000080), 0x80000001, 0x162842) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000001ac0)={r2, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0xf, 0x2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)=[0x0], &(0x7f0000000340), 0x0, 0x7b, 0x0, 0x0, 0x10, &(0x7f00000003c0), &(0x7f0000000380), 0x8, 0x90, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000340), 0x0) listen(r0, 0xfffff789) r1 = accept(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x9, 0x8, 0x0, 0x1, 0xd0, 0x6, 0x2}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0x0, 0x2a, 0x4, 0xe0}, 0x9c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r3 = fsopen(&(0x7f0000000080)='hfsplus\x00', 0x1) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000000040)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x7fffffbf, 0x3a, '!\x91.\xdb)\xda\vY\x9a\xf0\x16}AL\xe3', 0x3a, '-^{\x00\x00\x00\x00', 0x3a, './file1'}, 0x3d) fsconfig$FSCONFIG_CMD_RECONFIGURE(r3, 0x7, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r7, @ANYRES32=r6, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r7, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r5}, 0x20) write$binfmt_elf64(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c4600040000ff7f00000000000003003e00ecfffbff94020000200000004000000000000000e503000000000000000000002c9f38000004"], 0x78) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x102) keyctl$revoke(0x3, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x3, 0x5004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) r3 = open(0x0, 0x108843, 0x98) fcntl$setlease(r3, 0x400, 0x0) setxattr$incfs_metadata(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0), 0x0, 0x0, 0x0) lremovexattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='user.incfs.metadata\x00') sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioprio_get$uid(0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', 0x0}) r4 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r5, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="16", 0x1}], 0x1}}], 0x2, 0x48000) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10) unshare(0x42000000) unshare(0x64000600) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000340)=@filter={'filter\x00', 0x42, 0x4, 0x318, 0xffffffff, 0x1e8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x280, 0x280, 0x280, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0x17}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@ah={{0x30}, {[0x8001, 0x1ff], 0x1}}, @common=@icmp={{0x28}, {0xb, "b22f"}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@empty, @loopback, 0x0, 0x0, 'vlan1\x00', 'dvmrp0\x00', {}, {}, 0x24, 0x0, 0x4}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x378) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000280)={0x9}) syz_clone3(0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) mlockall(0x7) write(r1, &(0x7f00000002c0)='0', 0x1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0500000005000000020000000700000000000000", @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="004000000000000000000000000000000000000000000000000000007f46aa4a0458a50fbbc6b49f7cd60b2d3c46c8aefcabacacaf7b7180c31862affe1b674b50455ce7c8c6176e020a5363de486397ca1502647ceebbf3be23df88815ce44588b6ba95f0dcb10a9262775267b4e3e3468b6f8e601aed2ad142754420127f88eac9f61701a5a3cbc474b3e515be2a0227c972f7271d5ce1e36fabf453d3ba2e6f8f9e9ba953f8773e07b152985c20a0e490503cb145008888b58574d4f00f5a3b777fd86be839bc36636014cdbab1fcf8cdf5e9844b065312ef93251688702661a42aa88c6db011c69882af8a4dbebb7dc0470d130e9c7a327885117bb2dd7cc3f07efe35a022c13ed22f3f7128b67b10f067af78dbb60edd11ce46ace1c2811072d5131f6963770b46fa197ef018ac80deaeb98c7f3fb8b413cfc4e9a6e83e829bb9e4e26d467a54594e74a5574739d0d288668c4275e9ae7975f6f35f5a96af9c40b6bcc1d10d05de1a4baa0c39de76c39d2ce0d0"], 0x50) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x30e02, 0x0) recvmmsg(r3, &(0x7f0000003340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=""/64, 0x40}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}], 0x2, 0x40000002, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) recvmsg$unix(r3, &(0x7f00000004c0)={0x0, 0xfffffffffffffd21, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x20) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x111401, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYRES64], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat(r1, &(0x7f0000000040)='./file1\x00', 0x5c3a43, 0x48) syz_open_dev$cec(&(0x7f0000005a40), 0x0, 0x1) executing program 0: socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0xa0, &(0x7f0000000080)={0x0, 0xb9d8, 0x2}) mkdir(&(0x7f00000004c0)='./file2\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='127.0.0.1:/\x00', &(0x7f0000000540)='./file2\x00', &(0x7f0000000580)='nfs\x00', 0x0, &(0x7f00000005c0)='addr=127.0.0.1,vers=3,proto=udp\x00') sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYBLOB='\x00'/18, @ANYRES32, @ANYRES32, @ANYBLOB], 0x50) semget(0x3, 0x4, 0x69c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff010000"], 0xe4}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x89fc, &(0x7f0000000340)={'bond0\x00', @random="00009e0c1100"}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) getsockname$packet(r1, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="38000000100037040000", @ANYRES32, @ANYBLOB="c3040500000000001800128008000100677470000c00028008000100", @ANYRES32], 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x74}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x15d) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007465") write(0xffffffffffffffff, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00mirror\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00core 2 1024 nosync 2 7:0 0 7:1 0 1 handle_error', 0x57) ioctl(r4, 0xc138fd09, &(0x7f0000000000)="040000000000000000000000a0010000380100000100"/37) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfed5, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00', @ANYRESOCT, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32, @ANYRESHEX=0x0], 0x30}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x18d) write$cgroup_subtree(r5, &(0x7f0000000180)=ANY=[], 0x8) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240), 0x4000095, 0x0) executing program 32: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) getsockname$packet(r1, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="38000000100037040000", @ANYRES32, @ANYBLOB="c3040500000000001800128008000100677470000c00028008000100", @ANYRES32], 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x74}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x15d) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007465") write(0xffffffffffffffff, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00mirror\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00core 2 1024 nosync 2 7:0 0 7:1 0 1 handle_error', 0x57) ioctl(r4, 0xc138fd09, &(0x7f0000000000)="040000000000000000000000a0010000380100000100"/37) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfed5, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00', @ANYRESOCT, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32, @ANYRESHEX=0x0], 0x30}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x18d) write$cgroup_subtree(r5, &(0x7f0000000180)=ANY=[], 0x8) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240), 0x4000095, 0x0) executing program 5: open(0x0, 0x480920, 0x146) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$inet_udp(0x2, 0x2, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='aufs\x00', 0x10414a3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f0000000200)={0x5a1, 0x1, 0x7fffffff, 0xffffffff}) unshare(0x22020400) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f00000000c0), 0x12) r3 = dup(r2) write$P9_RSETATTR(r3, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) waitid(0x0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000200)) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00040006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000001ac0)={r5, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) writev(r7, &(0x7f0000019540)=[{&(0x7f0000019440)='3', 0x1}, {&(0x7f0000019480)="cb", 0x1}], 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r0, 0xfffff789) r1 = accept(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x9, 0x8, 0x0, 0x1, 0xd0, 0x6, 0x2}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x1000, 0x1000, 0x7ffe, 0x0, 0x2a, 0x4, 0xe0}, 0x9c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r3 = fsopen(&(0x7f0000000080)='hfsplus\x00', 0x1) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000000040)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x7fffffbf, 0x3a, '!\x91.\xdb)\xda\vY\x9a\xf0\x16}AL\xe3', 0x3a, '-^{\x00\x00\x00\x00', 0x3a, './file1'}, 0x3d) fsconfig$FSCONFIG_CMD_RECONFIGURE(r3, 0x7, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r7, @ANYRES32=r6, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r7, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r5}, 0x20) write$binfmt_elf64(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c4600040000ff7f00000000000003003e00ecfffbff94020000200000004000000000000000e503000000000000000000"], 0x78) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x102) keyctl$revoke(0x3, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) executing program 3: setns(0xc9, 0x0) r0 = socket(0x8, 0x0, 0x7ffc) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f00000003c0)={0x27, 0x0, 0x0, 0x7, 0x0, 0xd2, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x11) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[], 0x0, 0x3f, 0x0, 0x0, 0x7, 0x10000}, 0x28) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x40010, r5, 0xd6fff000) r6 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r7 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r7, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c89770000fdfd", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r6, 0x403c6f2b, 0x0) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40103d0b, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x52, 0x0, &(0x7f0000000080)) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r9, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000080)=@ethtool_perm_addr={0x1a, 0x39, "5c83276f6ca662254709b89e1e0000010000000000335b021f55001d00000000000000000000008c1972b27d555a50e65cb6f46365d51d8f91"}}) ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x100000000000000) executing program 1: socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0xa0, &(0x7f0000000080)={0x0, 0xb9d8, 0x2}) mkdir(&(0x7f00000004c0)='./file2\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='127.0.0.1:/\x00', &(0x7f0000000540)='./file2\x00', &(0x7f0000000580)='nfs\x00', 0x0, &(0x7f00000005c0)='addr=127.0.0.1,vers=3,proto=udp\x00') sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYBLOB='\x00'/18, @ANYRES32, @ANYRES32, @ANYBLOB], 0x50) r3 = semget(0x3, 0x4, 0x69c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01"], 0xe4}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x89fc, &(0x7f0000000340)={'bond0\x00', @random="00009e0c1100"}) semop(r3, &(0x7f0000000080)=[{0x3, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) semop(r3, &(0x7f0000000340)=[{0x2, 0x7f, 0x1800}, {0x1, 0xbbdb, 0x1000}, {0x1, 0x5}], 0x3) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) r1 = landlock_create_ruleset(0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) landlock_restrict_self(r1, 0xe) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socket$kcm(0x10, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0xa00, 0x801) ioctl$DRM_IOCTL_SET_VERSION(r3, 0xc0106407, &(0x7f00000000c0)={0x1, 0x2}) ioctl$DRM_IOCTL_SET_VERSION(r3, 0xc0106407, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv4/vs/est_cpulist\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='0', 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000040)={'filter\x00', 0x0, [0x3f73e8dd, 0x2, 0xfffffff0, 0x1, 0x6]}, &(0x7f00000003c0)=0x54) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f00000000c0)}, 0x463}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x402}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000000, 0x0) executing program 3: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f00000002c0)=@multiplanar_userptr={0x0, 0xd, 0x4, 0x4, 0x71, {}, {0x1, 0x0, 0x6, 0xbd, 0x4, 0x2, "c0093bef"}, 0x7ff, 0x2, {0x0}, 0xffff}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg$sock(r4, &(0x7f00000044c0), 0x4000000000001c0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) recvfrom(0xffffffffffffffff, &(0x7f0000000340)=""/48, 0xfffffffffffffd15, 0x40000000, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x6, &(0x7f0000000300)=ANY=[@ANYBLOB="bfa200000000000007020000c0ffffffb703000040000000b7040000009e0000850000004500000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, r6, 0x25, 0x2, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x202, 0x188) write$mtd(r8, &(0x7f0000000180)="0db0f1604d161238c9bfb1d7c0886da19395f02e860a7ab973ebf16311c62029ce6eb1116ff8fb8bef05729944525ee13259dbf5b4fe0e13a0a753981c3a4c6ded537cdd1740008402ef99b3bfdd7769b85fea98a3d171a6cd0fb76ddca86adb0b9f2656c80415269480105c0b50f01a3f23773b0d8ae2414b933074874a7ee82fc9fcd3e363c2fbe5f952dc46c81c44ac8bedb291cc0cd11165d27bcceb613284afdab210", 0xa5) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r9 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x32, 0xf7, 0x3, 0x80, 0x7, 0xc0, 0xc, 0xc, 0x4, [0x5, 0x9, 0x10, 0x6, 0x6, 0x8, 0x400, 0x2174]}}) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c000280"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x6a) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x8004001}, 0x800) executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1cc) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x400000, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0) io_setup(0x4, &(0x7f00000013c0)=0x0) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r4, 0x0, 0x0) io_submit(r3, 0x1, &(0x7f0000002c00)=[&(0x7f00000000c0)={0x20000000, 0x0, 0x7, 0x8, 0x0, r2, 0x0}]) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {0x7}}, './pipefs\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) read$FUSE(0xffffffffffffffff, &(0x7f0000000b40)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sched_getparam(r5, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r7 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) mknod$loop(&(0x7f0000000040)='./pipefs/gssd/clntXX/gssd\x00', 0x100, 0x1) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) executing program 2: r0 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bind$alg(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r3, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x19, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000005000000000000001000000818110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r5}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r7 = getpid() sched_setscheduler(r7, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0xff224000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x12, 0x0, 0x0, &(0x7f00000002c0)='GPL\x00', 0x33, 0x8f, &(0x7f0000000400)=""/143, 0x0, 0x48, '\x00', 0x0, @cgroup_sock_addr=0x34, 0xffffffffffffffff, 0x8, &(0x7f0000000640)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000000c0)={0x9, 0x3, 0x81c6, 0xe}, 0x10, 0x0, 0xffffffffffffffff, 0xa, &(0x7f0000000740)=[0xffffffffffffffff, r3, r9], &(0x7f0000000780)=[{0x5, 0x5, 0x9, 0x5}, {0x2, 0x5, 0xf}, {0x0, 0x1, 0x5, 0xc}, {0x0, 0x4, 0x0, 0x5}, {0x0, 0x4, 0x4, 0x7}, {0x1, 0x4, 0x0, 0x8}, {0x0, 0x5, 0x5, 0x5}, {0x4, 0x1, 0x10001, 0x2}, {0x2, 0x5, 0x6, 0x4}, {0x0, 0x3}], 0x10, 0xc}, 0x94) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x24000000) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) keyctl$clear(0x7, r0) r10 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x40481, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20044035}, 0x400c041) r11 = dup(r10) ioctl$KVM_CREATE_VM(r11, 0xae01, 0x40) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x44) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'geneve0\x00', 0x0}) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x40, 0x14, 0x1, 0x4, 0x0, {0xa}, [@typed={0x4}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@mcast1}, @nested={0x14, 0x2, 0x0, 0x1, [@generic="bf74a7dffdd8f8331b9dd3f2f9834b7f"]}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000804}, 0x8018) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000840)={0x5, {{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x3, 0x0, @mcast1}}}, 0x108) syz_usb_connect$midi(0x3, 0x44, &(0x7f0000000440)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x45e, 0x283, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x32, 0x1, 0x1, 0xfd, 0x10, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x7c, [@midi_out_jack={0x7, 0x24, 0x3, 0x2, 0x0, 0x0, [], 0x5}, @midi_out_jack={0x13, 0x24, 0x3, 0x0, 0x8, 0x6, [{0x6e, 0x3}, {0x5, 0x8}, {0xe, 0x35}, {0x3, 0x7}, {0x8, 0x4}, {0xb, 0x7}], 0x7}, @midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x2, 0x53}]}}}}}]}}, &(0x7f00000009c0)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x110, 0x2d, 0x40, 0x10, 0x20, 0x5}, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="050f450000"]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000b80)='./file0\x00', 0x0, 0x0) acct(0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000bc0)=@deltclass={0x8c, 0x29, 0x980, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0xfff2, 0xfff2}, {0x3, 0x5}, {0x6, 0xb}}, [@tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_htb={{0x8}, {0x40, 0x2, [@TCA_HTB_CEIL64={0xc, 0x7, 0x7}, @TCA_HTB_PARMS={0x30, 0x1, {{0x5, 0x0, 0x3, 0x100, 0x2, 0x1}, {0x7, 0x2, 0x8, 0x7, 0x1, 0x3}, 0x4, 0x8, 0xf, 0x113c, 0xeda8}}]}}, @tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_fq_codel={0xd}]}, 0x8c}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a40)=@deltfilter={0x84, 0x2d, 0x20, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0xfff1, 0x5}, {0x4, 0xa}, {0x3, 0xffff}}, [@TCA_CHAIN={0x8, 0xb, 0x9}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xb, 0x2}}]}}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff1, 0x10}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x0, 0x1}}]}}, @TCA_CHAIN={0x8, 0xb, 0x7}]}, 0x84}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000800)=@deltfilter={0x34, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1, 0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x80002, 0x8) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote, 0x7}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x4e27, 0x20000, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x108) close_range(r3, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e23, @remote}, 0x2, 0x4, 0x1}}, 0x26) syz_emit_ethernet(0x32, &(0x7f0000000000)={@link_local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x22}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) r8 = openat2(0xffffffffffffffff, &(0x7f0000001800)='./file0\x00', &(0x7f0000001840)={0x100, 0x10, 0x8c329ffb7ff21cb}, 0x18) ioctl$TIOCGETD(r8, 0x5424, &(0x7f0000001880)) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r0 = syz_ublk_setup_io_uring(0x616, &(0x7f0000000340)={0x0, 0xe87f, 0x40, 0x2, 0x5f}, &(0x7f0000000400), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) dup(r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r2 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r5) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYRESOCT=r4, @ANYRESOCT=r1, @ANYRESOCT=0x0], 0x14}}, 0x200080c0) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r9, &(0x7f0000000300)='r:_est/event1 ./file0:0x0 arg2=%bx', 0x22) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x6a) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x8004001}, 0x800) executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000fea000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, 0x0}, 0x68) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./trace\x00', 0x17b) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dummy\x00', 0x42, 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) getsockopt$SO_TIMESTAMP(r4, 0x1, 0x23, &(0x7f0000000140), &(0x7f0000000180)=0x4) write(r4, &(0x7f0000000400)='p:lygroup/myevent ./dummy:0x2', 0x1d) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c0010", @ANYRES16=r2, @ANYBLOB="95e81c56b0c66eed25bebda6bb7d6f0579e9be7fc1d3415e372e90873f8c0ec583088faf27205301bcc953f7877985f275f5696efe769853d32963ab68f463", @ANYRESOCT=r2, @ANYRESDEC=r0, @ANYRES16=r1], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)=@random={'trusted.', '%/*\xcf\x00'}) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCGSW(r6, 0x8040451b, &(0x7f0000000080)=""/29) ioctl$EVIOCSMASK(r6, 0x40104593, &(0x7f00000004c0)={0x4, 0xa5, &(0x7f0000000400)="2072871afeed7ef366b116932ec3edd94c2c93389a7c88e3df51d56cb0079f5b969d472c97a4c5e530c2dce0975dae4c751c8a86a2702d505ea96b19cbd08b9fcacbc4740255be90e15b2bbe8da850fbca97ef4d241ec54fb5fb50bb84d8a032c1eb47d8b481928352ad4e7bc74771ad53b76148caaca5dbdc6c9e76f85be9c6ffbcb8de534a0c20658fb9974633321dc2e94cc07391db9d435442c7af91903d64b91294b7"}) landlock_create_ruleset(&(0x7f0000000340)={0x4fd591a0f54e709c, 0x2, 0x3, 0x5, 0x8}, 0x30, 0x3) r7 = getpid() add_key(&(0x7f0000000540)='dns_resolver\x00', 0x0, &(0x7f0000000080)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f43657274696669636174652076650d169d5489541d4e6f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303239313632365a303a3138303606035504030c2f43657274696269636174652076657269666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c880700000071039ee2fe6e6a714ec7299f90e177989fc2e70f82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1debf3f9656929ff48068efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d0403020347f7304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d88", 0x1d9, 0xfffffffffffffffd) sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x6) executing program 1: openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r2, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x2, {0x2, 0x0, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) r3 = socket$kcm(0xa, 0x5, 0x0) close(0x3) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000423346da092cbe220de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad04a82ff3cfadcf65eb92adc6c68d66b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976a9a362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e248deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a825360423c1cbc8b5d19167152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd77125d98120358900000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca450139c558000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de4295777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f502cdf1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfd125a9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141399ed926b822becead7a0a2b4a4c008ab16b616d60f347e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c442ad2fe9baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc0000001a002364bbd93964a8d0bdc802b9be2500"/3636], &(0x7f0000000040)='GPL\x00', 0x4, 0xfdc0, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) setsockopt$sock_attach_bpf(r3, 0x29, 0x22, &(0x7f0000000100)=r4, 0x120) sendto$inet6(r2, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000500)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x38}}}}, 0x84) socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@rights={{0x10}}, @rights={{0x10}}], 0x20}, 0x400000e0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c000280"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x6a) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x8004001}, 0x800) executing program 1: openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0xe2a02) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000040)={0x8, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x4, "000000000400"}) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000001040)={{r0, 0x2, 0x8000000, 0x2741, 0x1, 0x2, 0x565c, 0x5, 0xe, 0x81, 0x3, 0x7, 0xffffffffffffff0b, 0x4, 0x3}}) io_uring_setup(0x1b54, &(0x7f0000000100)={0x0, 0x1d49, 0x400, 0x4, 0x3d8}) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x800000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r5, &(0x7f00000000c0)={0x2, 0x20, @remote}, 0x10) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/crypto\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x4000000000010046) sendto$inet(r5, 0x0, 0x0, 0x4044894, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(r4, &(0x7f0000000080), 0x72a, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f7274"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a31"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) socket$netlink(0x10, 0x3, 0xc) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) r2 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x41, 0x1ff) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$setlease(r3, 0x400, 0x1) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1d, 0x7, 0x8, 0x1, 0x2020, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x1000}, 0x50) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) landlock_restrict_self(r4, 0x0) r6 = open$dir(&(0x7f0000000100)='./file0\x00', 0x90100, 0x100) fspick(r6, 0x0, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[], 0x17) prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_open_dev$hidraw(&(0x7f0000000000), 0x9, 0xd038c0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = fsopen(&(0x7f0000000200)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) executing program 2: openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$inet_udp(0x2, 0x2, 0x0) setns(0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000240)={'wlan1\x00', &(0x7f00000002c0)=@ethtool_stats}) socket$igmp6(0xa, 0x3, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000002) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x2275, 0xffffffffffffffff) r4 = open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) sendfile(r4, r4, 0x0, 0x1000000201005) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88}, 0x400000e0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r0 = syz_ublk_setup_io_uring(0x616, &(0x7f0000000340)={0x0, 0xe87f, 0x40, 0x2, 0x5f}, &(0x7f0000000400), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) dup(r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r2 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r5) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYRESOCT=r4, @ANYRESOCT=r1, @ANYRESOCT=0x0], 0x14}}, 0x200080c0) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_io_uring_setup(0xf03, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r9, &(0x7f0000000300)='r:_est/event1 ./file0:0x0 arg2=%bx', 0x22) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x20, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x58010}, 0x44) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'geneve0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x40, 0x14, 0x1, 0x4, 0x0, {0xa}, [@typed={0x4}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@mcast1}, @nested={0x14, 0x2, 0x0, 0x1, [@generic="bf74a7dffdd8f8331b9dd3f2f9834b7f"]}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000804}, 0x8018) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000840)={0x5, {{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x3, 0x0, @mcast1}}}, 0x108) syz_usb_connect$midi(0x3, 0x89, &(0x7f0000000580)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x1, 0x1, 0x0, 0x10, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x5, 0x1, 0x3, 0x20, 0x7c, [@midi_out_jack={0x7, 0x24, 0x3, 0x2, 0x8, 0x0, [], 0x5}], [{{0x9, 0x5, 0x2, 0x4, 0x40, 0x6, 0x2, 0x1, {0x4}}}, {{0x9, 0x5, 0x80, 0x0, 0x10, 0xbe, 0x8, 0xc, {0xa, 0x25, 0x1, 0x6, "a48a0a9d0284"}}}, {{0x9, 0x5, 0xe, 0x3, 0x0, 0x7, 0xc, 0x10, {0xe, 0x25, 0x1, 0xa, "08c68efc27e18035e48b"}}}, {{0x9, 0x5, 0xe, 0x10, 0x3ff, 0x38, 0xa2, 0xd, {0x11, 0x25, 0x1, 0xd, "707361a1c4c40813cf6301a5f5"}}}, {{0x9, 0x5, 0x8, 0x0, 0x10, 0x3, 0x30, 0x81, {0x4}}}]}}}}}]}}, &(0x7f00000009c0)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x110, 0x2d, 0x40, 0x10, 0x20, 0x5}, 0x5, &(0x7f0000000700)={0x5, 0xf, 0x5}}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000b80)='./file0\x00', 0x0, 0x0) acct(0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newtfilter={0x44, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1, 0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x1}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x2}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000b00)=@newtfilter={0x44, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x2, 0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x2}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x2}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000800)=@deltfilter={0x34, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1, 0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x80002, 0x8) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote, 0x7}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x4e27, 0x20000, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x108) close_range(r3, 0xffffffffffffffff, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e22, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) syz_emit_ethernet(0x32, &(0x7f0000000000)={@link_local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x22}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) r9 = openat2(0xffffffffffffffff, &(0x7f0000001800)='./file0\x00', &(0x7f0000001840)={0x100, 0x10, 0x8c329ffb7ff21cb}, 0x18) ioctl$TIOCGETD(r9, 0x5424, &(0x7f0000001880)) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc', 0x9) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x4902, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="6c0000008510000002000500000095000000000000000000a50500"/36], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmmsg$inet(r1, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000001c0)="f0477f9ebecbb3e977872288d943285bfda70ad3b6e868ec54d4d40ab3bf72d35f964ab920be22d4759fab005f141e9fb7536dcd5beb265f407fe0f9a38f247b1b0093c61f41ae2800593d34725fe8238667268e3f40c6e1f0e6d1856747a15c9800adfdf079eb163ee7d3cbaa5a9b8124e664354a8e5d2316ced61f5319f634bd60af1c4f56b5", 0x87}, {&(0x7f0000000700)="1e5f78a440adb6d0cf89b9ee3bc4fcc76f0a550dfa2ac304f28973ba8dbdffd49a3aa6f18f22c5a363ebc95fa67f48c25cb65762f586d7f361da6e34520a732127c0ed5afd9c5af982bce23443f9edeeb1879b1e226f254e1a33d6c5b182f3ddfeecdf2dcd", 0x65}, {&(0x7f0000000780)="93fd28d2e0adce4d6742ffa107f29e9193d5426680bcfebfcbc4db471b301ed40e234367a8252d741146f99d2f5dbb217b236584765eb497a37c698feb8743955f7471b70ee6f996df2beb18fd748f40d4b3ed52252ef98c7e9fe8d39c27c46929a11b9a7c553102e6f824ce6cd9561d19b1530b88a63ff7e0cb12d2c1ee484d19f1fadc9b2150033018acfbe1166e14c0c0ee2e63b79dfbe5bdb8139d48e484cad1656b358875", 0xa7}, {&(0x7f0000000840)="46496586ca5c4c8beba73b3220e203a084277b6000c13faac37126d06834f62dfc9036153deee513cc5c46b730c5bd4efd202024f239dce16e1d5d17ef1ef32c7f8dd3ed7f2e8538b9055a662928eb34d5413a046c170576f9f00b0b7b6f1ed87185bb58c98b9a8a72578f169c940833e566c4366ae6ba5c12b94cf52fe6a5ca499b09a5c5fd949189896c956977d8c79e39c7758bfed06c", 0x98}], 0x4, &(0x7f0000000940)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}}, {{&(0x7f0000000980)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000ac0)=[{&(0x7f00000009c0)="f79199f27bde7237e9986194e45a29ce4c16d85a8c6e4408e76ccf84f4dc548ac03b4d2a6a8160f0cf99bcf7dc7a1401938b85a6208593073ab01db111c0fc04902dca9a986adce11cac148ea3377ef4884cdc8eb949774ae913149436e2b33be7f72e6cebedf0ea8bccb1892b19f2676ae826831461adbe2f24af8865b73b00a18897115afba1242fa2297f5c8606e51167f455dd85a2562c3823b97b7c0d7e6cd0c03b89bd4fb83e26f4ca562d99334041cf6cfd085ea0783086ad0be015a9c4c900a781fb2c7764ea18d7d7d8f84b", 0xd0}], 0x1, &(0x7f0000000e40)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x800}}, @ip_ttl={{0x14, 0x0, 0x2, 0x19}}, @ip_ttl={{0x14, 0x0, 0x2, 0xb4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast}}}], 0x80}}, {{&(0x7f0000000ec0)={0x2, 0x4e20, @local}, 0x10, &(0x7f00000015c0)=[{&(0x7f0000000f00)="ed9b835d6baae58cfc845654101aac741e906b22760ce9b5e40779f1be03aaa8a028efa92b3f2ad93e8fcf6ed1428730b51ddd5ce9045323731966848f69c539c8ab60b66408c20806a23e975558c922f9be7a3ca915cc617b9eb90cc0d0d969e854ac9c69ae7f6f", 0x68}, {&(0x7f0000000f80)="5e05e11d586cc49e25053d39624f73bc986e", 0x12}, {&(0x7f0000000fc0)="f2a6c4b5354706e50adba3e66126eb383139b868bd306cbf480964ea5756163fd743a655ff16e570e04044c031d0079d96464980b6ffe0d606ad2e47ee7cb3de0b832720f834b893247f727c2033ac836e4fd3b620c51403c81b2b973dfcce3cf56d37af78b0695f77bf34ea437a7993487d10365dcff576c7ce5a349c0e4d7a49f1", 0x82}, {&(0x7f0000001080)="d7ce76f60ff1d5bcab5e2941b539bd25e036e45c68c3272d0ab187bead1b38b0acaeae1fc58ba822b1e6927897b9899ba61e9c1128283103b69db1ff0134b6b77673972b5b863509834519c489e6ade0cf8a23f9d63cfa8f32d2dd248c4affe2c99a5f69b54ed6bed291d56d7882763702185c51d80e27eca9189b4df5117bb4be86b1ad3986d02ca48ee1bed99df3222034f6d096a855708c40dda09b", 0x9d}, {&(0x7f0000001140)="d191197e782d1372bc0e524078cc3e665a12869510e26d408d570d82a7ae3dd59485822c32e5520069f9c15d7853e75c81f2074b62a66746776146b6af90a3221dce72a4414cb24548dce4e6ba363857faab96d7dbaa4dc11b5372dfa714eb24f9f8c137f160bff85d26a421dc167f7d017616306dd5be59162f7827b69bfa6512a4dc16039ab37afbe2464ee96a73d98488e370b179ef8621f230be483052142cb390e48c79424f965ac49fa89566bf30d7f0ff77aa9b2abbec33b448e65258c65b86a74f2a4d153ca6f16e8fafc10ccc7e7e66e2a70cda697a31fd5d21adb662dc57ec2047e06a73dacdb9", 0xec}, {&(0x7f0000001240)="7f07e1faca13be1639f1dd578d1e9002fce4293b990f2dfdad39af399c1ad7cbf4b8330cb83785eee44c25f6a6ec1535ece6c9cee9a76ee84f5de6c4d220cdb37b0ff7d5f6e8cb53ff2fecec67212e882e6267fce3ef49088e32b0927f6f174ed38edd167c082ba3095b88b4288c0f354f3d6a8cd61b9cdb1dc8b8eab92827caea04cfff6e66384e3cac3c312748fd0eb335959b96a2eaf6f2059a9ec8fb6cbbbf7a166cf7429ad7b04937d8b48698e32342e4ffa3a59bbc6affb43aadce7f8d210aa37b5f3ec115519d10a3b5d7ed333e8ea7cefff14d674788e52ee9ee050c338eaab7ef6a765857c6c3659e8ac85f6dbb7a9d44f28bc9bec0", 0xfa}, {&(0x7f0000001340)="b7e6bd54d4feee8014514a960824d9cfede00970f29f0d555049c79a7f0ba2e073cb70d186072212d509bc2f8017d4c6e61aba948e179cc2060e43c07621936f29634c3705421aa7f8cf5a9168f934b9e39c817201c0a40e7db8f7f88d10aac5051550a9635938928b44b995ce0f502da14e031f64a85b8faa1c9e5f17adc82cf4ca769061c3ff9cb989dc6975d63b926766fd5f6f87fc3254b839b8356e99a97b305a8fa63de0fe3c0a316d534b514d599e8fd98dedbaae43f4df208d2d1e92eabff0ddcfd8bbdb4d", 0xc9}, {&(0x7f00000014c0)="be7194e2c2b9a3871acbda6dbffdb97377413280cb576a35b5a4d83bd5b0a67d76010ce585e86b1ed76ac1bb8a1ef1533a0c114e09fda1e4f69eeb4fbee111eab0f0ba3bf909fbe90864e37af956a1e0f0ccc4816554a03a48e39f84ffec748386b2c0eac7c623372c0cae723d221ef8d571866475a72687130d7e7f6913e8ad3aa81ff091d619ae145d2e3beed839ce6c36b25f0bdd1b8854fb8bb7cd93f1e9d6e59ec855081134d29ff247c089f2f24507ab6a056c42bb53706093159800ea850e54b5412ab75d5930ada70ba1d9395039a85c5f1be10d", 0xd8}], 0x8}}], 0x3, 0x20000004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x2, &(0x7f0000000000)=ANY=[], 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x90}, 0x94) unlink(0x0) executing program 2: socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf9477000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semop(0x0, &(0x7f0000000100)=[{0x0, 0x80, 0x1000}], 0x1) semctl$SETVAL(0x0, 0x0, 0x10, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) sendmmsg$inet(r0, &(0x7f00000016c0), 0x0, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, 0x0, &(0x7f0000000040)) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={0x0, 0x40}, 0x8) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f0000000400)='devices.list\x00', 0x0, 0x0) semctl$GETZCNT(0x0, 0x0, 0xf, &(0x7f00000002c0)=""/136) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x7, 0x10c4404, 0x2, 0x6, 0x7, 0x6, 0x0, 0x0, 0x4}}, 0xff18) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, 0x0) executing program 4: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\b\x00\b', 0x8, 0x3a, 0x0, @loopback, @loopback, {[], @echo_request={0x80, 0x0, 0x0, 0x3, 0x31}}}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}, 0x80) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r3, &(0x7f0000019380)={'#! ', './file0', [{0x20, '\x15\xe6\x8e\\\xfe\x15^\xca\xbb\x88B\xeb\x90FAv\xdc\xbc\x1eiU\b\xc2D\xdb\xca\x9d\xb4oL\xe92\x7f+\f\x0e\xfd\xceTC\x1f;u\x84E\x04\xe3B19xO\xc2\xd4.Mp\xf4\x80{e\x87\xc4V\xe0\x99\x99\x8b\x93I\x8a\xb3\xce*\x9b\xd0X\aA0S\x02k\xdb\x12\v\x9c\x10nY\x85\x92\xf6\x93\xc4%\x0f\x80.\x8d\x9b\x15\x8e\xf4LWr\x14\x9eKh\x97L\xb4\x03\xe9=\x8e\xff\xf0\xb1al\xb6\xc9\xa1/L\x8c7\xa0\x8eD\x1f,\x93`\xc0h\xacjGx\xb8\x9cv\x99bA\xc5]\b\xf8\xa5\x9b\x1c\xeeKB\xdd\xe8\xbboT\x90\x84k\xae\xb5\xfa\xd9\x0f\xd4T<\x0f\xdb\xec\x05HcN\xae;\x87\x00\x00\x00\x00\b\x92\xa7\xdf\x1dS\x00\x8b\x81\xf4\x84X*\xa6e\x922|FO\v\xa6\x17jG\xe3]'}]}, 0xe4) close(r3) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000019100)={[&(0x7f0000000200)=' ']}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x37, &(0x7f0000000180)={&(0x7f0000019480)=ANY=[@ANYBLOB="440000004000070109ad700000010000017c00000c00fc8008000180feff00000c000380080006005bba3506b1d9743457983c69b87596f2888af78c78364e866379f2762f5d4615faa1499355b9aabdf862f45df0784d23803d6772851e084e3158c019dfeeb10e56c07ece8b8f8b6b0ac32aa0bf2da8eb7883bfc650ef8f0fafdae6a5508ebe79528085473f1cbcd0a3be303a8c0fa0c4c86ef7f1e442eefeb6d9cb4430e526542bcf3895a0dd45e45521b0c453ce501280b6a9bbeee172ba180ac017871564c88ac557547ccfd0d3a9d1eea9dcf490057649797fe18568e0f587adc3ecaf18c68a2f61918c27a161d9f926553490d6f5c7ae1355aa085e1fc768bd19636a85a53ef89287a90943a65e7fdc152015fb209e4b16a435eef4f5b9f26be5f9ab0e8bdc609a840467ffe393", @ANYRES32=0x0, @ANYRESDEC], 0x44}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) executing program 1: r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d00010000600009040080020300000009210604000122050009058103"], 0x0) syz_usb_disconnect(r0) r1 = gettid() timer_create(0x1, &(0x7f0000000200)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000000080)) getpgrp(r1) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000ff", @ANYBLOB="000000000a000200ec7f879d431000000800090004000000"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r5, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x48044) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r3}}, './file0\x00'}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000280)={0x78, 0x0, 0x0, 0xe, 0x4}) mkdirat(0xffffffffffffff9c, 0x0, 0x172) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = getpid() r9 = syz_pidfd_open(r8, 0x0) ioctl$FS_IOC_GETVERSION(r9, 0xff05, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0x0, &(0x7f0000000180)) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x6a) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x8004001}, 0x800) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) lseek(r0, 0x0, 0x3) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_notify={{0x3b, 0xa}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x59d5}}}, 0xd) bpf$MAP_CREATE(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = syz_open_procfs(0x0, &(0x7f00000023c0)='net/tcp\x00') read$FUSE(r3, &(0x7f0000002400)={0x2020}, 0x2020) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x9, &(0x7f0000000180)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x800}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}, {}, {}, {0x7, 0x0, 0xb, 0x7}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x14, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x1, 0x0, 0x40000005, 0xc01, 0xffffffffffffffff, 0x7}, 0x50) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x2d, 0x107, 0x0, 0x25dfdbff, {0x8, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0xc009}, 0xc810) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b702000008000000bfa300000000000007030000ffffffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000000000095000000000000006623848adf1dc9a764ab51a064caff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b81ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6b6981978d51514b00dcc4a2748b376358c33c9753beab62bdf27dc04e4cb4bc598affd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b770009524edd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd88345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1757b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c35af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d9900000011000003971b32fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d677d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc37e5aa23bff8cce0600000000000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68f536a03353a55a8a8e176e5d48887d31c8e0f77f2c1e68ec7c01bd5a2028a8fc107007f5f4c67600a6ade3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d9029f071fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b4492510134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2020ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498dedf0f87c38bbcab7357836f03e8a7c392e535694a3ead2de11e6b1781e2a017ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f6c3652c423ce6ecc1be5d4e8133fc32f68ea86a2df1e7df98a0ae216c405d0ae9eed114ff2d6fe27dfdff1cf9194849c4cc0da9533e5983863e526a7dc0d8728f3b573ca4427bdb44df9341e9b8420e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9467b51d92e0993af4beaf1f3d47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c27c318475802e2c62681bd1a331422a6e47bbd40857d52c4894944fae5c5000000000000000000000000e0c47613e950b6aefeae054fc723f62ac7d13941de11b018f1f48ac50335df91c771729f81929128135b2803562c1171ee00a3f4a31281aa363e087d53d86dd85e3ff979a7e72d16fdd7e1a0f07a1c8e6085d280d760f74975ceb3a5be6cfb4da8e0aeb769b8b75f4aad803ed77d34872eed2711aa40a3b38099dc2752e8ec9b520faf39e416752aa0830206736570f5d41a4df848c9052551cf8dcb1be000000000eb2577188e8e96bd825d462350905d3eb916b397d2a46a64081e85661d7a5a2716cc87cb1976d15d9b6418e94f165911803e43830432226c660f4da67bb7c8ceb3755c07197d8b80b8d16b12c2ec63bebe107aa2350a7ae564bf69a6c52a2da1496016dd66a1c1b112"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2000}, 0x8, 0x10, &(0x7f0000000880)={0x0, 0xc}, 0x10}, 0x94) executing program 4: setns(0xc9, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8947, &(0x7f00000002c0)={'bond0\x00', @random="d8b30100"}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$can_bcm(0x1d, 0x2, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x39b3) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x3400c014}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40004000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0027400000000000000c7f14000000110001"], 0xb4}}, 0x8044) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="501a00000d0a010800000000000000000a0000000900020073797a31000000000900010073797a3100000000241a038018013f800c00018006000100003f01000800034000000002"], 0x1a50}}, 0x8000) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r7, @ANYRES32=r4, @ANYBLOB='&'], 0x10) r8 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x11c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xb, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x20, 0x6, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x6, 0x8, 0xc3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f00000000c0)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x3d1, {0x9, 0x21, 0xfffe}}}, &(0x7f0000000040)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r7, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r3}, 0x20) recvmmsg(r3, &(0x7f0000005b80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/163, 0xa3}], 0x1}, 0x6}], 0x1, 0x0, 0x0) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) r9 = dup3(r2, r1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r9) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r9) sendmsg$DEVLINK_CMD_PORT_GET(r9, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x16c, r10, 0x200, 0x70bd25, 0x25dfdbfb, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x5}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x4000080}, 0xc800) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r0, 0x10e, 0x2, &(0x7f0000000080)=""/22, &(0x7f00000000c0)=0x16) inotify_init() fsopen(&(0x7f0000000280)='hfsplus\x00', 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) r2 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)={0x1}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}, {0xeda8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x3, 0x3f8, 0x0, 0x0, 0x2004cb, 0x3, 0x0, 0xfffffffffffffff8, 0x0, 0x9, 0x2000000000003ff, 0x2], 0x2000, 0x200206}) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000300)=0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x4e23, 0x9, @local, 0x6}}, 0x0, 0x0, 0x2f, 0x0, "03c2769bf71d7836323485466b1ab4062438333b0365838e9d56324587db0009466206f9bd19e028710cd7a9a0524637e9cc8f9dc099fc3aecf50f4d209cb4733d2af1e022a74f0d66fba11caeef38f8"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x4e23, 0x8, @private1, 0x9}}, 0x0, 0x0, 0x4c, 0x0, "7b799f1d4745079190b73f3b45e35de32b51923bb935276866e9632dc8ab2bc3a26e79b2b2fd684c355dbfd019ce7156473c7c7f406b7608759f7535f4bf4a4ee839ab668eaae363999075d28b685dd4"}, 0xd8) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d70300000000000000d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df6c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8a9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2a9e99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8be1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaa072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a3ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a98838156ff00000000000000cdbf91f7582ab314be3e67b8c9459564c856339a80919ecf839560c62e69df8667b274cc53f83f2086cfd2664252471fad9081824d60741d663ee258705c364e162b84a09870acd0a19399103474444f4fa12dcbd10b40195b6088513029b60a34e4161fe48c092693eb07dc8ddcba2eac2efe30b285a877c862c73ff8a60cf73f1b17da0000000000005664181c1f28cd2880e6872bae932eaf4b0000000000007b662c0fe22cfd6d4bd7b851ae928cebeec6375b16af342e93c39d97e5d74d5a8e96c15fdcde7526b0af54b145e61b042c1e600390590a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) r7 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="0022891424ae", @ANYRES64=r7], 0xb2) ioctl$VIDIOC_LOG_STATUS(r2, 0x5646, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000500)={@dev={0xfe, 0x80, '\x00', 0x2}, 0x40}) r8 = socket$inet(0x2, 0x4000000805, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x30000) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f00000002c0)) sendmmsg$inet_sctp(r8, &(0x7f00000038c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x4800}], 0x1, 0x40c4) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x1) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x6a) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x8004001}, 0x800) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-mkdirat$cgroup_root-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched-sendmsg$ETHTOOL_MSG_FEATURES_SET detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x1) program crashed: KASAN: slab-use-after-free Read in ep_open single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-mkdirat$cgroup_root-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-mkdirat$cgroup_root-ioctl$sock_inet_sctp_SIOCINQ detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-mkdirat$cgroup_root-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x1ff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-pread64-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r6, &(0x7f00000004c0)=""/4089, 0xfffffffffffffeb3, 0x7fd) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r6, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: WARNING in dummy_free_request testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-sendmsg$nl_route_sched-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0x601, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-sendmsg$nl_route_sched-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r4, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-bind$netlink-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r4, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-socket$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-openat-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-mount-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) write(r1, &(0x7f0000000800), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) write(r0, &(0x7f0000000a00), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: WARNING in dummy_free_request testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)="010000000705810240000007058102000200", 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-read-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-read-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-read-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-openat-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-mount-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000a00), 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mkdirat-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_GET_PROG_INFO-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000a00), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000900)="0000010000000000000001") bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xffff}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200008c1}, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program did not crash testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-ioctl-bind$netlink-socket$nl_route-close_range-openat$procfs-ioctl$sock_inet_sctp_SIOCINQ-sendmsg$nl_route_sched detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x40104d00, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4041080) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true reproducing took 1h40m25.919366105s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff888036f77058 by task syz.3.133/6096 CPU: 1 UID: 0 PID: 6096 Comm: syz.3.133 Not tainted syzkaller #0 PREEMPT(full) Hardware Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f049d79e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff9007f968 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f049da25fa0 RCX: 00007f049d79e199 RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c RBP: 00007f049d8358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f049da25fac R14: 00007f049da25fa0 R15: 00007f049da25fa0 Allocated by task 6097: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1611 [inline] gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1702 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1893 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6097: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6509 [inline] kfree+0x22b/0x6d0 mm/slub.c:6802 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline] put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1592 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1665 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724 device_remove+0xcb/0x180 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832 driver_unregister+0x76/0xb0 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888036f77000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 88 bytes inside of freed 512-byte region [ffff888036f77000, ffff888036f77200) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36f74 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c031c80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c031c80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4976, tgid 4976 (udevadm), ts 23824129157 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] kernfs_fop_open+0x23d/0xd50 fs/kernfs/file.c:634 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 4976 tgid 4976 ts 23819254601 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x2cc/0x840 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] kernfs_fop_write_iter+0x26a/0x5f0 fs/kernfs/file.c:322 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036f76f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888036f76f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888036f77000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888036f77080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036f77100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff888036f77058 by task syz.3.133/6096 CPU: 1 UID: 0 PID: 6096 Comm: syz.3.133 Not tainted syzkaller #0 PREEMPT(full) Hardware Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f049d79e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff9007f968 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f049da25fa0 RCX: 00007f049d79e199 RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c RBP: 00007f049d8358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f049da25fac R14: 00007f049da25fa0 R15: 00007f049da25fa0 Allocated by task 6097: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1611 [inline] gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1702 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1893 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6097: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6509 [inline] kfree+0x22b/0x6d0 mm/slub.c:6802 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline] put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1592 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1665 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724 device_remove+0xcb/0x180 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832 driver_unregister+0x76/0xb0 drivers/base/driver.c:202 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888036f77000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 88 bytes inside of freed 512-byte region [ffff888036f77000, ffff888036f77200) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36f74 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c031c80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c031c80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4976, tgid 4976 (udevadm), ts 23824129157 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] kernfs_fop_open+0x23d/0xd50 fs/kernfs/file.c:634 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x19fa/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 4976 tgid 4976 ts 23819254601 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x2cc/0x840 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] kernfs_fop_write_iter+0x26a/0x5f0 fs/kernfs/file.c:322 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036f76f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888036f76f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888036f77000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888036f77080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036f77100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================