Extracting prog: 26m2.402018419s
Minimizing prog: 15m18.013789686s
Simplifying prog options: 0s
Extracting C: 36.977052153s
Simplifying C: 4m7.424461888s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-mkdirat-mount-openat-getdents64-openat-openat-read-close_range-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 25, 3, 1, 7, 10, 6, 15, 28, 3, 3, 1, 20, 12, 15, 9, 19, 30, 1, 21, 14, 4, 9, 17]
detailed listing:
executing program 2:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 2:
syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0)
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x7, "07bbfe000000000000000000000000000000000000000000e4ff00000000001c", <r1=>0xffffffffffffffff})
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xfc, 0x7fff0026}]})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1})
r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}})
ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x3, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800})
close_range(r2, 0xffffffffffffffff, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r4, 0x0)
quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmsg(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}, 0x49cf75490397e68f)
recvmsg$unix(r7, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x41)
ioctl$SIOCSIFHWADDR(r7, 0x8905, &(0x7f0000000340)={'ip6_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}})
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10)
r9 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f00000001c0)="c38f724d3086eb07287dce077883fcce6b69d3ae521ead02dac533fd00427baab0d7e0ad265bf0a9dc41629cb1d69aa431a3998115a8643ce175f60f9f4a4a3553bb42a26a82aff07abb966d1f4479ae3805492521e8313e28caf7767d29e33c8df1753a695b7ab57df59a56b35fa4d427acb1446ba46287c13112b9c936169159acee6f21", &(0x7f0000000180)=@udp=r9}, 0x20)
sendmmsg$inet6(r4, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="b0", 0x1}], 0x1}}], 0x1, 0x0)
ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000280)=[{}]})
syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=ANY=[@ANYBLOB="8000000008021100000108021100000008021100000000000009000000000000640001000006020202020202010882848b960c121824"], 0x36)
executing program 1:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x2}, 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="3a0c41383b216e3604bf8d3336b3458abbbd2dd5db51a0387a85a4d1144b515d3edb96cb3379033e51ba3e128d1fcbdc68eebb4ad2ab29ee3db45b54827418ee38cbeb97e2ed401b1217ad965dbc9979665067c5ddf928a86fcb995ab9e10e4ec2b96f6318cd4ede6527fc23f09f954777bb102fe2240a2ba225feee2518c011a914ada13915fcefdfbf810390a08b03b3c2de1956da408282aa845da33a1b0e647ddebedf434ad0f37448ec061cd19e5a26e4e4291f9933480495848c3d7e10c901c963a902f12efa500ba2f9b2abe9fbc370fcd823523f5dede3884d2075bc26f6c84786c7de1672e7db33"], 0x50)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', <r1=>0x0})
r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) (async)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)=@can={0x1d, r1}, 0x80, 0x0}, 0x8080) (async)
ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0)
executing program 2:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet6(r0, &(0x7f0000003880)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1000, @private1}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000080)="9a", 0x1}], 0x1}}], 0x1, 0x4004851)
r1 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r2 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c)
connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff204e000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, 0x0, 0x0, 0x0)
shutdown(r0, 0x1)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000200)={&(0x7f0000708000/0x4000)=nil, &(0x7f000081f000/0x3000)=nil, 0x4000, 0x1})
syz_emit_vhci(0x0, 0x7)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, 0x0, 0x0, 0x400c080)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8)
bpf$PROG_LOAD(0x5, 0x0, 0x27)
r4 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={0x0, 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x20000800)
r5 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
add_key(0x0, 0x0, 0x0, 0x0, r5)
bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50)
r6 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r6, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900})
r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3})
ioctl$VIDIOC_QUERYMENU(r7, 0xc008561c, &(0x7f0000000100)={0x980900, 0x3, @name="6c14f9104c575323652bb05c9764e27d0235e28510452c132c1eaa54d11e47a7"})
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$KDSETMODE(r0, 0x4b3a, 0x400000)
executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r0, &(0x7f0000000080)="800009e92208a1ce", 0xfdef, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c)
getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000000)=""/32, &(0x7f00000000c0)=0x20)
executing program 3:
bpf$MAP_CREATE(0xf0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff"], 0x50)
executing program 0:
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x5, 0x803, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000180)=0xffff, 0x4)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
r3 = socket(0x10, 0x803, 0x0)
r4 = socket(0x10, 0x803, 0x2)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="4cb34f13c522dc652bbd7000fedbdf251c000000ea78c80065a24df0bb3e274d9062ec0538522110f4056bead31b6f05d4845f8630daff462a4da38a56ab1694c630592e8d03ec518c91ffdfc85e5a82ee45e782871cd7307a7b7cacbd2a0d18a21284821e9950f1", @ANYRES32=r6, @ANYBLOB="08000000080004000c00000008000100ac14141508000800", @ANYRES32=0x0, @ANYBLOB="08000a00ff00000008000b00010000000800090000000100080001000000000008000400ffff0000"], 0x5c}, 0x1, 0x0, 0x0, 0x20}, 0x24000000)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0)
openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x10800)
close_range(r7, 0xffffffffffffffff, 0x0)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2})
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
executing program 3:
r0 = socket(0x2, 0x80805, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_ublk_setup_io_uring(0x4020, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000040)=<r4=>0x0, &(0x7f00000004c0)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x44, 0x0, r1, 0x0, 0x0, 0x0, 0x40000000})
syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0xc, {0xfff, 0x7}}, 0x1)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10)
r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f0000000040))
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x25, &(0x7f00000004c0)={0x0, @in={{0x2, 0x0, @private=0xa010101}}, 0x79}, 0x90)
executing program 0:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x9, 0x3, 0xc4f, 0x1, 0x1}, 0x50)
syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00')
setns(0xc9, 0x0)
socket(0x8, 0x5, 0x5)
syz_ublk_setup_io_uring(0x1b1d, &(0x7f0000000080)={0x0, 0x1c3f, 0x2, 0x2, 0xf1}, 0x0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$kcm(0x29, 0x5, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="8400000010000305000000040000000000ffffff", @ANYRES32=0x0, @ANYBLOB="1546010007ef0000540012800c0001006d6163766c616e004400028006000200010000000800090001efa8000800030003000000080007000500000008000100100000000600020001000000040005800a000400aaaaaaaaaa2e000008000500", @ANYRES16=r0], 0x84}}, 0x20008040)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0)
close(r1)
socket$netlink(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x8, 0x2, 0x7, 0x10, 0x7, 0x7, 0x7, 0x7ff, 0x3, 0x1f, 0xc, 0x1b, 0x6, 0xffffffff, 0x5}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9)
sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x40000)
executing program 2:
r0 = socket(0x10, 0x5, 0xfffffffc)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x2c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {0x2}, {0x7, 0xfff1}}, [@TCA_CHAIN={0x8, 0xb, 0x10000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000400000000000900020073797a32000000001400078008000840060000b10800064000000fff0500050002"], 0x60}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x18, r3, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)
fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="01000000020000000000006b", 0xc, 0xffffffffffffffff)
recvmmsg$unix(r0, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f00000002c0)=""/219, 0xdb}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/144, 0x90}, {&(0x7f0000001740)=""/222, 0xde}], 0x4}}, {{&(0x7f0000000580), 0x6e, &(0x7f0000002940)=[{&(0x7f0000000640)=""/15, 0xf}, {&(0x7f0000001880)=""/82, 0x52}, {&(0x7f0000001900)=""/50, 0x32}, {&(0x7f0000001940)=""/4096, 0x1000}], 0x4, &(0x7f0000002980)=[@cred={{0x1c}}], 0x20}}], 0x2, 0x10041, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x4040005)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x3, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)
connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001840), 0x4)
r6 = creat(&(0x7f0000002a40)='./file0\x00', 0x1b3)
bind$can_j1939(r6, &(0x7f0000000180)={0x1d, r1, 0x1, {0x2, 0xf0, 0x4}, 0x2}, 0x18)
sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0)
fgetxattr(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656d2e23ccaaaaaa"], &(0x7f00000004c0)=""/153, 0x99)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 2:
mount(&(0x7f00000000c0)=@sr0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000140)='hfsplus\x00', 0x204001, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x3002a8d, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (async)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async)
capset(&(0x7f0000000280)={0x20071026}, &(0x7f0000000340)) (async)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$chown(0x4, r1, 0xee01, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000300)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000400)='base=0x20004000 size=0x4000 type=write-back\n\x00', 0x2a) (async)
listen(r0, 0x6) (async)
write(0xffffffffffffffff, &(0x7f0000000500)='base=0x0 size=0x40000000 type=write-back\n\x00', 0x29)
write(0xffffffffffffffff, &(0x7f0000000600)='base=0x20000000 size=0x40000000 type=uncachable\n\x00', 0x2e) (async)
write(0xffffffffffffffff, &(0x7f0000000700)='disable=0\n\x00', 0xa) (async)
write(0xffffffffffffffff, &(0x7f0000000800)='base=0x10000000 size=0x10000000 type=write-combining\n\x00', 0x33) (async)
ioctl(0xffffffffffffffff, 0x40104d05, &(0x7f0000000900)="00000100000000000000010001000000") (async)
ioctl(0xffffffffffffffff, 0x40104d06, &(0x7f0000000a00)="00000200000000000000020001000000")
ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, 0x0)
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000)) (async)
r2 = dup(0xffffffffffffffff)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'})
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', <r2=>0x0})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = dup(r4)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r0, &(0x7f0000003800)=[{&(0x7f0000000100)="2e1221b23bb63f7f77d3df163e75963d86ddf06712e9000d2f8db0049d904972df48040000dbb8a10000", 0x2a}, {&(0x7f0000000240)="000001010000", 0x6}, {&(0x7f0000000280)="a43b2eaab40000", 0x7}, {&(0x7f0000000140)="00000000010000", 0x7}], 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/usb1/urbnum\x00', 0x0, 0x0)
read(r6, &(0x7f0000000380), 0x64)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0xc00, &(0x7f0000000300)={&(0x7f0000000240)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x9, 0x2a, [@random={0xdd, 0x3, 'abc'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x38}}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, 0x0, {0x7, 0x29, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x1}}, 0x50)
r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x202, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000200)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_VFIO_IOAS$SET(r1, 0x3b88, &(0x7f0000000000)={0xc, r2})
ioctl$IOMMU_VFIO_SET_IOMMU(r1, 0x3b66, 0x1)
ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r1, 0x3b72, &(0x7f0000000440)=ANY=[])
getsockopt$inet6_tcp_int(r0, 0x6, 0x7, 0x0, &(0x7f0000000140))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x80)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <23>
bisect: split chunk #0 of len 23 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 3, 3, 1, 20, 12, 15, 9, 19, 30, 1, 21, 14, 4, 9, 17]
detailed listing:
executing program 1:
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, 0x0, 0x0, 0x0)
shutdown(r0, 0x1)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000200)={&(0x7f0000708000/0x4000)=nil, &(0x7f000081f000/0x3000)=nil, 0x4000, 0x1})
syz_emit_vhci(0x0, 0x7)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, 0x0, 0x0, 0x400c080)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8)
bpf$PROG_LOAD(0x5, 0x0, 0x27)
r4 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={0x0, 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x20000800)
r5 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
add_key(0x0, 0x0, 0x0, 0x0, r5)
bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50)
r6 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r6, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900})
r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3})
ioctl$VIDIOC_QUERYMENU(r7, 0xc008561c, &(0x7f0000000100)={0x980900, 0x3, @name="6c14f9104c575323652bb05c9764e27d0235e28510452c132c1eaa54d11e47a7"})
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$KDSETMODE(r0, 0x4b3a, 0x400000)
executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r0, &(0x7f0000000080)="800009e92208a1ce", 0xfdef, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c)
getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000000)=""/32, &(0x7f00000000c0)=0x20)
executing program 3:
bpf$MAP_CREATE(0xf0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff"], 0x50)
executing program 0:
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x5, 0x803, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000180)=0xffff, 0x4)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
r3 = socket(0x10, 0x803, 0x0)
r4 = socket(0x10, 0x803, 0x2)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="4cb34f13c522dc652bbd7000fedbdf251c000000ea78c80065a24df0bb3e274d9062ec0538522110f4056bead31b6f05d4845f8630daff462a4da38a56ab1694c630592e8d03ec518c91ffdfc85e5a82ee45e782871cd7307a7b7cacbd2a0d18a21284821e9950f1", @ANYRES32=r6, @ANYBLOB="08000000080004000c00000008000100ac14141508000800", @ANYRES32=0x0, @ANYBLOB="08000a00ff00000008000b00010000000800090000000100080001000000000008000400ffff0000"], 0x5c}, 0x1, 0x0, 0x0, 0x20}, 0x24000000)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0)
openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x10800)
close_range(r7, 0xffffffffffffffff, 0x0)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2})
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
executing program 3:
r0 = socket(0x2, 0x80805, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_ublk_setup_io_uring(0x4020, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000040)=<r4=>0x0, &(0x7f00000004c0)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x44, 0x0, r1, 0x0, 0x0, 0x0, 0x40000000})
syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0)
openat$vimc2(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0xc, {0xfff, 0x7}}, 0x1)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10)
r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f0000000040))
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x25, &(0x7f00000004c0)={0x0, @in={{0x2, 0x0, @private=0xa010101}}, 0x79}, 0x90)
executing program 0:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x9, 0x3, 0xc4f, 0x1, 0x1}, 0x50)
syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00')
setns(0xc9, 0x0)
socket(0x8, 0x5, 0x5)
syz_ublk_setup_io_uring(0x1b1d, &(0x7f0000000080)={0x0, 0x1c3f, 0x2, 0x2, 0xf1}, 0x0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$kcm(0x29, 0x5, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="8400000010000305000000040000000000ffffff", @ANYRES32=0x0, @ANYBLOB="1546010007ef0000540012800c0001006d6163766c616e004400028006000200010000000800090001efa8000800030003000000080007000500000008000100100000000600020001000000040005800a000400aaaaaaaaaa2e000008000500", @ANYRES16=r0], 0x84}}, 0x20008040)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0)
close(r1)
socket$netlink(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x8, 0x2, 0x7, 0x10, 0x7, 0x7, 0x7, 0x7ff, 0x3, 0x1f, 0xc, 0x1b, 0x6, 0xffffffff, 0x5}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9)
sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x40000)
executing program 2:
r0 = socket(0x10, 0x5, 0xfffffffc)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x2c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {0x2}, {0x7, 0xfff1}}, [@TCA_CHAIN={0x8, 0xb, 0x10000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000400000000000900020073797a32000000001400078008000840060000b10800064000000fff0500050002"], 0x60}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x18, r3, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)
fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="01000000020000000000006b", 0xc, 0xffffffffffffffff)
recvmmsg$unix(r0, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f00000002c0)=""/219, 0xdb}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/144, 0x90}, {&(0x7f0000001740)=""/222, 0xde}], 0x4}}, {{&(0x7f0000000580), 0x6e, &(0x7f0000002940)=[{&(0x7f0000000640)=""/15, 0xf}, {&(0x7f0000001880)=""/82, 0x52}, {&(0x7f0000001900)=""/50, 0x32}, {&(0x7f0000001940)=""/4096, 0x1000}], 0x4, &(0x7f0000002980)=[@cred={{0x1c}}], 0x20}}], 0x2, 0x10041, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x4040005)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x3, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)
connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001840), 0x4)
r6 = creat(&(0x7f0000002a40)='./file0\x00', 0x1b3)
bind$can_j1939(r6, &(0x7f0000000180)={0x1d, r1, 0x1, {0x2, 0xf0, 0x4}, 0x2}, 0x18)
sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0)
fgetxattr(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656d2e23ccaaaaaa"], &(0x7f00000004c0)=""/153, 0x99)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 2:
mount(&(0x7f00000000c0)=@sr0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000140)='hfsplus\x00', 0x204001, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x3002a8d, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (async)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async)
capset(&(0x7f0000000280)={0x20071026}, &(0x7f0000000340)) (async)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$chown(0x4, r1, 0xee01, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000300)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000400)='base=0x20004000 size=0x4000 type=write-back\n\x00', 0x2a) (async)
listen(r0, 0x6) (async)
write(0xffffffffffffffff, &(0x7f0000000500)='base=0x0 size=0x40000000 type=write-back\n\x00', 0x29)
write(0xffffffffffffffff, &(0x7f0000000600)='base=0x20000000 size=0x40000000 type=uncachable\n\x00', 0x2e) (async)
write(0xffffffffffffffff, &(0x7f0000000700)='disable=0\n\x00', 0xa) (async)
write(0xffffffffffffffff, &(0x7f0000000800)='base=0x10000000 size=0x10000000 type=write-combining\n\x00', 0x33) (async)
ioctl(0xffffffffffffffff, 0x40104d05, &(0x7f0000000900)="00000100000000000000010001000000") (async)
ioctl(0xffffffffffffffff, 0x40104d06, &(0x7f0000000a00)="00000200000000000000020001000000")
ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, 0x0)
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000)) (async)
r2 = dup(0xffffffffffffffff)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'})
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', <r2=>0x0})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = dup(r4)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r0, &(0x7f0000003800)=[{&(0x7f0000000100)="2e1221b23bb63f7f77d3df163e75963d86ddf06712e9000d2f8db0049d904972df48040000dbb8a10000", 0x2a}, {&(0x7f0000000240)="000001010000", 0x6}, {&(0x7f0000000280)="a43b2eaab40000", 0x7}, {&(0x7f0000000140)="00000000010000", 0x7}], 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/usb1/urbnum\x00', 0x0, 0x0)
read(r6, &(0x7f0000000380), 0x64)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0xc00, &(0x7f0000000300)={&(0x7f0000000240)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x9, 0x2a, [@random={0xdd, 0x3, 'abc'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x38}}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, 0x0, {0x7, 0x29, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x1}}, 0x50)
r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x202, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000200)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_VFIO_IOAS$SET(r1, 0x3b88, &(0x7f0000000000)={0xc, r2})
ioctl$IOMMU_VFIO_SET_IOMMU(r1, 0x3b66, 0x1)
ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r1, 0x3b72, &(0x7f0000000440)=ANY=[])
getsockopt$inet6_tcp_int(r0, 0x6, 0x7, 0x0, &(0x7f0000000140))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x80)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 25, 3, 1, 7, 10, 6, 15, 19, 30, 1, 21, 14, 4, 9, 17]
detailed listing:
executing program 2:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 2:
syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0)
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x7, "07bbfe000000000000000000000000000000000000000000e4ff00000000001c", <r1=>0xffffffffffffffff})
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xfc, 0x7fff0026}]})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1})
r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}})
ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x3, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800})
close_range(r2, 0xffffffffffffffff, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r4, 0x0)
quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmsg(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}, 0x49cf75490397e68f)
recvmsg$unix(r7, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x41)
ioctl$SIOCSIFHWADDR(r7, 0x8905, &(0x7f0000000340)={'ip6_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}})
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10)
r9 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f00000001c0)="c38f724d3086eb07287dce077883fcce6b69d3ae521ead02dac533fd00427baab0d7e0ad265bf0a9dc41629cb1d69aa431a3998115a8643ce175f60f9f4a4a3553bb42a26a82aff07abb966d1f4479ae3805492521e8313e28caf7767d29e33c8df1753a695b7ab57df59a56b35fa4d427acb1446ba46287c13112b9c936169159acee6f21", &(0x7f0000000180)=@udp=r9}, 0x20)
sendmmsg$inet6(r4, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="b0", 0x1}], 0x1}}], 0x1, 0x0)
ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000280)=[{}]})
syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=ANY=[@ANYBLOB="8000000008021100000108021100000008021100000000000009000000000000640001000006020202020202010882848b960c121824"], 0x36)
executing program 1:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x2}, 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="3a0c41383b216e3604bf8d3336b3458abbbd2dd5db51a0387a85a4d1144b515d3edb96cb3379033e51ba3e128d1fcbdc68eebb4ad2ab29ee3db45b54827418ee38cbeb97e2ed401b1217ad965dbc9979665067c5ddf928a86fcb995ab9e10e4ec2b96f6318cd4ede6527fc23f09f954777bb102fe2240a2ba225feee2518c011a914ada13915fcefdfbf810390a08b03b3c2de1956da408282aa845da33a1b0e647ddebedf434ad0f37448ec061cd19e5a26e4e4291f9933480495848c3d7e10c901c963a902f12efa500ba2f9b2abe9fbc370fcd823523f5dede3884d2075bc26f6c84786c7de1672e7db33"], 0x50)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', <r1=>0x0})
r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) (async)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)=@can={0x1d, r1}, 0x80, 0x0}, 0x8080) (async)
ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0)
executing program 2:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet6(r0, &(0x7f0000003880)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1000, @private1}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000080)="9a", 0x1}], 0x1}}], 0x1, 0x4004851)
r1 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r2 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c)
connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff204e000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0)
close(r1)
socket$netlink(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x8, 0x2, 0x7, 0x10, 0x7, 0x7, 0x7, 0x7ff, 0x3, 0x1f, 0xc, 0x1b, 0x6, 0xffffffff, 0x5}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9)
sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x40000)
executing program 2:
r0 = socket(0x10, 0x5, 0xfffffffc)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x2c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {0x2}, {0x7, 0xfff1}}, [@TCA_CHAIN={0x8, 0xb, 0x10000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000400000000000900020073797a32000000001400078008000840060000b10800064000000fff0500050002"], 0x60}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x18, r3, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)
fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="01000000020000000000006b", 0xc, 0xffffffffffffffff)
recvmmsg$unix(r0, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f00000002c0)=""/219, 0xdb}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/144, 0x90}, {&(0x7f0000001740)=""/222, 0xde}], 0x4}}, {{&(0x7f0000000580), 0x6e, &(0x7f0000002940)=[{&(0x7f0000000640)=""/15, 0xf}, {&(0x7f0000001880)=""/82, 0x52}, {&(0x7f0000001900)=""/50, 0x32}, {&(0x7f0000001940)=""/4096, 0x1000}], 0x4, &(0x7f0000002980)=[@cred={{0x1c}}], 0x20}}], 0x2, 0x10041, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x4040005)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x3, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)
connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001840), 0x4)
r6 = creat(&(0x7f0000002a40)='./file0\x00', 0x1b3)
bind$can_j1939(r6, &(0x7f0000000180)={0x1d, r1, 0x1, {0x2, 0xf0, 0x4}, 0x2}, 0x18)
sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0)
fgetxattr(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656d2e23ccaaaaaa"], &(0x7f00000004c0)=""/153, 0x99)
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 2:
mount(&(0x7f00000000c0)=@sr0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000140)='hfsplus\x00', 0x204001, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x3002a8d, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (async)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async)
capset(&(0x7f0000000280)={0x20071026}, &(0x7f0000000340)) (async)
r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$chown(0x4, r1, 0xee01, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000300)='base=0x20000000 size=0x20000 type=write-back\n\x00', 0x2c) (async)
write(0xffffffffffffffff, &(0x7f0000000400)='base=0x20004000 size=0x4000 type=write-back\n\x00', 0x2a) (async)
listen(r0, 0x6) (async)
write(0xffffffffffffffff, &(0x7f0000000500)='base=0x0 size=0x40000000 type=write-back\n\x00', 0x29)
write(0xffffffffffffffff, &(0x7f0000000600)='base=0x20000000 size=0x40000000 type=uncachable\n\x00', 0x2e) (async)
write(0xffffffffffffffff, &(0x7f0000000700)='disable=0\n\x00', 0xa) (async)
write(0xffffffffffffffff, &(0x7f0000000800)='base=0x10000000 size=0x10000000 type=write-combining\n\x00', 0x33) (async)
ioctl(0xffffffffffffffff, 0x40104d05, &(0x7f0000000900)="00000100000000000000010001000000") (async)
ioctl(0xffffffffffffffff, 0x40104d06, &(0x7f0000000a00)="00000200000000000000020001000000")
ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, 0x0)
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000)) (async)
r2 = dup(0xffffffffffffffff)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'})
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', <r2=>0x0})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = dup(r4)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r0, &(0x7f0000003800)=[{&(0x7f0000000100)="2e1221b23bb63f7f77d3df163e75963d86ddf06712e9000d2f8db0049d904972df48040000dbb8a10000", 0x2a}, {&(0x7f0000000240)="000001010000", 0x6}, {&(0x7f0000000280)="a43b2eaab40000", 0x7}, {&(0x7f0000000140)="00000000010000", 0x7}], 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/usb1/urbnum\x00', 0x0, 0x0)
read(r6, &(0x7f0000000380), 0x64)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0xc00, &(0x7f0000000300)={&(0x7f0000000240)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x9, 0x2a, [@random={0xdd, 0x3, 'abc'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x38}}, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000440)={0x50, 0x0, 0x0, {0x7, 0x29, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x1}}, 0x50)
r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x202, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000200)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_VFIO_IOAS$SET(r1, 0x3b88, &(0x7f0000000000)={0xc, r2})
ioctl$IOMMU_VFIO_SET_IOMMU(r1, 0x3b66, 0x1)
ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r1, 0x3b72, &(0x7f0000000440)=ANY=[])
getsockopt$inet6_tcp_int(r0, 0x6, 0x7, 0x0, &(0x7f0000000140))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x80)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 25, 3, 1, 7, 10, 6, 15, 17]
detailed listing:
executing program 2:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 2:
syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0)
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x7, "07bbfe000000000000000000000000000000000000000000e4ff00000000001c", <r1=>0xffffffffffffffff})
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xfc, 0x7fff0026}]})
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1})
r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}})
ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x3, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800})
close_range(r2, 0xffffffffffffffff, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r4, 0x0)
quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmsg(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}, 0x49cf75490397e68f)
recvmsg$unix(r7, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x41)
ioctl$SIOCSIFHWADDR(r7, 0x8905, &(0x7f0000000340)={'ip6_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}})
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10)
r9 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f00000001c0)="c38f724d3086eb07287dce077883fcce6b69d3ae521ead02dac533fd00427baab0d7e0ad265bf0a9dc41629cb1d69aa431a3998115a8643ce175f60f9f4a4a3553bb42a26a82aff07abb966d1f4479ae3805492521e8313e28caf7767d29e33c8df1753a695b7ab57df59a56b35fa4d427acb1446ba46287c13112b9c936169159acee6f21", &(0x7f0000000180)=@udp=r9}, 0x20)
sendmmsg$inet6(r4, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="b0", 0x1}], 0x1}}], 0x1, 0x0)
ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000280)=[{}]})
syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=ANY=[@ANYBLOB="8000000008021100000108021100000008021100000000000009000000000000640001000006020202020202010882848b960c121824"], 0x36)
executing program 1:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x2}, 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="3a0c41383b216e3604bf8d3336b3458abbbd2dd5db51a0387a85a4d1144b515d3edb96cb3379033e51ba3e128d1fcbdc68eebb4ad2ab29ee3db45b54827418ee38cbeb97e2ed401b1217ad965dbc9979665067c5ddf928a86fcb995ab9e10e4ec2b96f6318cd4ede6527fc23f09f954777bb102fe2240a2ba225feee2518c011a914ada13915fcefdfbf810390a08b03b3c2de1956da408282aa845da33a1b0e647ddebedf434ad0f37448ec061cd19e5a26e4e4291f9933480495848c3d7e10c901c963a902f12efa500ba2f9b2abe9fbc370fcd823523f5dede3884d2075bc26f6c84786c7de1672e7db33"], 0x50)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000001010000df7f0000ff00000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50)
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', <r1=>0x0})
r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) (async)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)=@can={0x1d, r1}, 0x80, 0x0}, 0x8080) (async)
ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0)
executing program 2:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet6(r0, &(0x7f0000003880)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1000, @private1}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000080)="9a", 0x1}], 0x1}}], 0x1, 0x4004851)
r1 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r2 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c)
connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff204e000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 10, 6, 15, 17]
detailed listing:
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', <r1=>0x0})
r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) (async)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)=@can={0x1d, r1}, 0x80, 0x0}, 0x8080) (async)
ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0)
executing program 2:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet6(r0, &(0x7f0000003880)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1000, @private1}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000080)="9a", 0x1}], 0x1}}], 0x1, 0x4004851)
r1 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r2 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c)
connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff204e000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15, 17]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 17]
detailed listing:
executing program 1:
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockname$packet(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x4804)
eventfd2(0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$igmp(0x2, 0x3, 0x2)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000", @ANYRES32=r6, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 17]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 17]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 17]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 17]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r6, &(0x7f0000000400)='dummy_hcd.0', 0xb)

program did not crash
minimized 6 calls -> 4 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 16]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 15]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)
close_range(r0, r0, 0x2)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 14]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)
read(r5, &(0x7f0000000400), 0x64)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
r4 = openat(r3, &(0x7f0000000243), 0x0, 0x0)
openat(r4, &(0x7f0000000300)='vcpu0/pid\x00', 0x0, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 12]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)
openat(r3, &(0x7f0000000243), 0x0, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000200), 0x1000)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./debugfs/kvm\x00', 0x0, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debugfs\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debugfs\x00', 0x1ff)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
executing program 0:
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
minimized 17 calls -> 4 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
bisect: concatenation succeeded
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400), 0x0) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: general protection fault in mon_notify
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_hcd.0', 0xb) (fail_nth: 10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in mon_notify
validation run: crashed=true
reproducing took 48m16.707583501s
repro crashed as (corrupted=false):
hub 5-0:1.0: 1 port detected
dummy_hcd dummy_hcd.0: remove, state 4
usb usb5: USB disconnect, device number 1
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 5 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 2 UID: 0 PID: 5929 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_del_entry_valid_or_report+0x20/0x1d0 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 41 54 55 53 48 89 fb 48 83 c7 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5b 01 00 00 48 89 da 48 8b 6b 08 48 b8 00 00 00
RSP: 0018:ffffc9000362fa20 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: fffff520006c5f22
RDX: 0000000000000001 RSI: ffffffff8c401500 RDI: 0000000000000008
RBP: ffff888054e4f000 R08: 0000000000000000 R09: fffffbfff2244efa
R10: ffffc9000362fa40 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff888054e4f0e8 R14: 0000000000000008 R15: 0000000000000000
FS:  0000555563368500(0000) GS:ffff8880d5fdc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe03795da08 CR3: 000000003c9f9000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:246 [inline]
 list_del include/linux/list.h:260 [inline]
 mon_bus_remove drivers/usb/mon/mon_main.c:203 [inline]
 mon_notify+0x84/0x480 drivers/usb/mon/mon_main.c:222
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 blocking_notifier_call_chain kernel/notifier.c:380 [inline]
 blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:368
 usb_remove_hcd.cold+0x25f/0x401 drivers/usb/core/hcd.c:3084
 dummy_hcd_remove+0x109/0x1e0 drivers/usb/gadget/udc/dummy_hcd.c:2761
 platform_remove+0x5f/0x80 drivers/base/platform.c:1456
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe036b9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd83a3bf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe036e25fa0 RCX: 00007fe036b9de99
RDX: 000000000000000b RSI: 0000200000000200 RDI: 0000000000000004
RBP: 00007fe036c33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe036e25fac R14: 00007fe036e25fa0 R15: 00007fe036e25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x20/0x1d0 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 41 54 55 53 48 89 fb 48 83 c7 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5b 01 00 00 48 89 da 48 8b 6b 08 48 b8 00 00 00
RSP: 0018:ffffc9000362fa20 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: fffff520006c5f22
RDX: 0000000000000001 RSI: ffffffff8c401500 RDI: 0000000000000008
RBP: ffff888054e4f000 R08: 0000000000000000 R09: fffffbfff2244efa
R10: ffffc9000362fa40 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff888054e4f0e8 R14: 0000000000000008 R15: 0000000000000000
FS:  0000555563368500(0000) GS:ffff8880d60dc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33363fff CR3: 000000003c9f9000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	f3 0f 1e fa          	endbr64
   e:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  15:	fc ff df
  18:	41 54                	push   %r12
  1a:	55                   	push   %rbp
  1b:	53                   	push   %rbx
  1c:	48 89 fb             	mov    %rdi,%rbx
  1f:	48 83 c7 08          	add    $0x8,%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 5b 01 00 00    	jne    0x18f
  34:	48 89 da             	mov    %rbx,%rdx
  37:	48 8b 6b 08          	mov    0x8(%rbx),%rbp
  3b:	48                   	rex.W
  3c:	b8                   	.byte 0xb8
  3d:	00 00                	add    %al,(%rax)

final repro crashed as (corrupted=false):
hub 5-0:1.0: 1 port detected
dummy_hcd dummy_hcd.0: remove, state 4
usb usb5: USB disconnect, device number 1
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 5 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 2 UID: 0 PID: 5929 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_del_entry_valid_or_report+0x20/0x1d0 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 41 54 55 53 48 89 fb 48 83 c7 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5b 01 00 00 48 89 da 48 8b 6b 08 48 b8 00 00 00
RSP: 0018:ffffc9000362fa20 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: fffff520006c5f22
RDX: 0000000000000001 RSI: ffffffff8c401500 RDI: 0000000000000008
RBP: ffff888054e4f000 R08: 0000000000000000 R09: fffffbfff2244efa
R10: ffffc9000362fa40 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff888054e4f0e8 R14: 0000000000000008 R15: 0000000000000000
FS:  0000555563368500(0000) GS:ffff8880d5fdc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe03795da08 CR3: 000000003c9f9000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:246 [inline]
 list_del include/linux/list.h:260 [inline]
 mon_bus_remove drivers/usb/mon/mon_main.c:203 [inline]
 mon_notify+0x84/0x480 drivers/usb/mon/mon_main.c:222
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 blocking_notifier_call_chain kernel/notifier.c:380 [inline]
 blocking_notifier_call_chain+0x69/0xa0 kernel/notifier.c:368
 usb_remove_hcd.cold+0x25f/0x401 drivers/usb/core/hcd.c:3084
 dummy_hcd_remove+0x109/0x1e0 drivers/usb/gadget/udc/dummy_hcd.c:2761
 platform_remove+0x5f/0x80 drivers/base/platform.c:1456
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe036b9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd83a3bf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe036e25fa0 RCX: 00007fe036b9de99
RDX: 000000000000000b RSI: 0000200000000200 RDI: 0000000000000004
RBP: 00007fe036c33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe036e25fac R14: 00007fe036e25fa0 R15: 00007fe036e25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x20/0x1d0 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 41 54 55 53 48 89 fb 48 83 c7 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5b 01 00 00 48 89 da 48 8b 6b 08 48 b8 00 00 00
RSP: 0018:ffffc9000362fa20 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: fffff520006c5f22
RDX: 0000000000000001 RSI: ffffffff8c401500 RDI: 0000000000000008
RBP: ffff888054e4f000 R08: 0000000000000000 R09: fffffbfff2244efa
R10: ffffc9000362fa40 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff888054e4f0e8 R14: 0000000000000008 R15: 0000000000000000
FS:  0000555563368500(0000) GS:ffff8880d60dc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33363fff CR3: 000000003c9f9000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	f3 0f 1e fa          	endbr64
   e:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  15:	fc ff df
  18:	41 54                	push   %r12
  1a:	55                   	push   %rbp
  1b:	53                   	push   %rbx
  1c:	48 89 fb             	mov    %rdi,%rbx
  1f:	48 83 c7 08          	add    $0x8,%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 5b 01 00 00    	jne    0x18f
  34:	48 89 da             	mov    %rbx,%rdx
  37:	48 8b 6b 08          	mov    0x8(%rbx),%rbp
  3b:	48                   	rex.W
  3c:	b8                   	.byte 0xb8
  3d:	00 00                	add    %al,(%rax)