Extracting prog: 36m46.117710483s
Minimizing prog: 11m18.818675331s
Simplifying prog options: 0s
Extracting C: 24.087222998s
Simplifying C: 3m58.318335835s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-syz_genetlink_get_family_id$nl80211-getpgrp-getpid-sched_setscheduler-mmap-syz_clone-syz_open_dev$MSR-read$msr-sched_setaffinity-syz_open_procfs-lseek
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
getpgrp(0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3)
r2 = syz_open_procfs(0x0, &(0x7f00000010c0)='net/fib_trie\x00')
lseek(r2, 0x2000, 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_write$ath9k_ep2-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[])
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x51, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xb, 0xfffb, 0xa}, 0x0, 0x0}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-syz_usb_connect-mkdirat-mount-syz_init_net_socket$bt_hci-syz_emit_vhci-syz_genetlink_get_family_id$nl80211-bind$bt_hci-write$binfmt_misc-openat-write-connect$inet-syz_emit_ethernet-mremap-ioctl$TCSETSW2-open-write$cgroup_type-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-ioctl$TIOCSTI-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac2-syz_usb_control_io$uac1-syz_usb_control_io$hid-syz_open_dev$I2C-ioctl$I2C_RDWR-syz_usb_control_io$lan78xx-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000140)={&(0x7f0000001680)})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000007c0)={0x44, &(0x7f0000000580)={0x40, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 19, 2, 8, 29, 10, 4, 12, 6, 10, 9, 11, 8, 19, 22, 22, 11, 19, 4, 8, 5, 5, 10, 13]
detailed listing:
executing program 3:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 3:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
socket$inet6(0xa, 0x3, 0x8000000003c)
bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0)
write(r1, &(0x7f0000000940)='naa.6', 0x5)
executing program 3:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000140)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000640))
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 1:
fchdir(0xffffffffffffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00')
fstat(0xffffffffffffffff, &(0x7f0000000340))
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x1, 0x0)
init_module(&(0x7f0000000d40)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x9, 0x2, 0x8, 0x3, 0x3, 0x6, 0x68, 0x1e8, 0x40, 0x274, 0x6, 0x3, 0x38, 0x2, 0xc, 0xce, 0x1}, [{0x70000000, 0x4, 0x8092, 0x0, 0x7, 0x4, 0x100, 0x5}, {0x6474e551, 0x10, 0x5, 0x7, 0xb, 0x9, 0x101, 0xd21}], "8debeca486ab3a", ['\x00', '\x00']}, 0x2b7, &(0x7f0000001040)='debugfs\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000002900)={0xfffffffffffffffa, r1, 0x0, {0x200, 0x81}, 0x4b}, 0x1)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0)
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0)
syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58)
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2200890, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='net/netfilter\x00')
getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@mcast1, 0x0, 0x2}, 0x0)
r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100))
executing program 3:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0)
write$UHID_INPUT(r0, 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000140)={&(0x7f0000001680)})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000007c0)={0x44, &(0x7f0000000580)={0x40, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, 0x0)
unshare(0x22020600)
r0 = fsopen(&(0x7f0000000040)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x88)
io_uring_enter(r1, 0x7c15, 0x49f, 0x6, 0x0, 0x0)
executing program 1:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x204)
r4 = socket$inet(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, 0x0, 0x0)
listen(0xffffffffffffffff, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @loopback, 0x15, 0x0, 'wrr\x00', 0x10}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000100)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0xe}, {@loopback, 0x4908, 0x0, 0x1}}, 0x44)
r5 = socket$inet(0x2, 0x1, 0x6)
connect(r5, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
socket$inet6(0xa, 0x3, 0x8000000003c)
bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0)
write(r1, &(0x7f0000000940)='naa.6', 0x5)
executing program 0:
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[])
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x51, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xb, 0xfffb, 0xa}, 0x0, 0x0}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 2:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xc}, {0xfff2, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56441, 0xf0b925, 0x80000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0x2, 0xf}, {0x5, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x8000)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa20000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d}, 0x94)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20040894)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22400, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r6, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
getpgrp(0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3)
r2 = syz_open_procfs(0x0, &(0x7f00000010c0)='net/fib_trie\x00')
lseek(r2, 0x2000, 0x1)

program crashed: general protection fault in dummy_udc_start
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 9, 11, 8, 19, 22, 22, 11, 19, 4, 8, 5, 5, 10, 13]
detailed listing:
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, 0x0)
unshare(0x22020600)
r0 = fsopen(&(0x7f0000000040)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x88)
io_uring_enter(r1, 0x7c15, 0x49f, 0x6, 0x0, 0x0)
executing program 1:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x204)
r4 = socket$inet(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, 0x0, 0x0)
listen(0xffffffffffffffff, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @loopback, 0x15, 0x0, 'wrr\x00', 0x10}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000100)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0xe}, {@loopback, 0x4908, 0x0, 0x1}}, 0x44)
r5 = socket$inet(0x2, 0x1, 0x6)
connect(r5, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
socket$inet6(0xa, 0x3, 0x8000000003c)
bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0)
write(r1, &(0x7f0000000940)='naa.6', 0x5)
executing program 0:
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[])
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x51, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xb, 0xfffb, 0xa}, 0x0, 0x0}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 2:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xc}, {0xfff2, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56441, 0xf0b925, 0x80000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0x2, 0xf}, {0x5, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x8000)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa20000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d}, 0x94)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20040894)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22400, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r6, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
getpgrp(0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3)
r2 = syz_open_procfs(0x0, &(0x7f00000010c0)='net/fib_trie\x00')
lseek(r2, 0x2000, 0x1)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 19, 4, 8, 5, 5, 10, 13]
detailed listing:
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
socket$inet6(0xa, 0x3, 0x8000000003c)
bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0)
write(r1, &(0x7f0000000940)='naa.6', 0x5)
executing program 0:
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[])
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x51, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xb, 0xfffb, 0xa}, 0x0, 0x0}})
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 2:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xc}, {0xfff2, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56441, 0xf0b925, 0x80000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0x2, 0xf}, {0x5, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x8000)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa20000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d}, 0x94)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20040894)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22400, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r6, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
getpgrp(0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3)
r2 = syz_open_procfs(0x0, &(0x7f00000010c0)='net/fib_trie\x00')
lseek(r2, 0x2000, 0x1)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 9, 11, 8, 19, 22, 22]
detailed listing:
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, 0x0)
unshare(0x22020600)
r0 = fsopen(&(0x7f0000000040)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x88)
io_uring_enter(r1, 0x7c15, 0x49f, 0x6, 0x0, 0x0)
executing program 1:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x204)
r4 = socket$inet(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, 0x0, 0x0)
listen(0xffffffffffffffff, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @loopback, 0x15, 0x0, 'wrr\x00', 0x10}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000100)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0xe}, {@loopback, 0x4908, 0x0, 0x1}}, 0x44)
r5 = socket$inet(0x2, 0x1, 0x6)
connect(r5, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 19, 22, 22]
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x204)
r4 = socket$inet(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, 0x0, 0x0)
listen(0xffffffffffffffff, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @loopback, 0x15, 0x0, 'wrr\x00', 0x10}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000100)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0xe}, {@loopback, 0x4908, 0x0, 0x1}}, 0x44)
r5 = socket$inet(0x2, 0x1, 0x6)
connect(r5, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 9, 11]
detailed listing:
executing program 1:
socketpair$unix(0x1, 0x2, 0x0, 0x0)
unshare(0x22020600)
r0 = fsopen(&(0x7f0000000040)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x88)
io_uring_enter(r1, 0x7c15, 0x49f, 0x6, 0x0, 0x0)
executing program 1:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x300, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850)
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e40)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r5, {0x0, 0xfff0}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x24040812)
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)

program did not crash
bisect: split chunks (needed=true): <4>, <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 11, 8, 19, 22, 22]
detailed listing:
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d1", 0x8}], 0x1}}], 0x1, 0x4000041)
setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x0, 0x1, {0x1, 0x1}, {0x1, 0x1, 0x4}, 0x2}, {0x2, 0x2, {0x1}, {}, 0x2, 0x1}, {0x2, 0x2, {0x2, 0xf0, 0x1}, {0x2, 0x1, 0x6}, 0x2}], 0x60)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x204)
r4 = socket$inet(0x2, 0x1, 0x0)
bind(0xffffffffffffffff, 0x0, 0x0)
listen(0xffffffffffffffff, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @loopback, 0x15, 0x0, 'wrr\x00', 0x10}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000100)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0xe}, {@loopback, 0x4908, 0x0, 0x1}}, 0x44)
r5 = socket$inet(0x2, 0x1, 0x6)
connect(r5, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 11, 22, 22]
detailed listing:
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 22, 22]
detailed listing:
executing program 0:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0)
listen(r0, 0xc)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 22, 22]
detailed listing:
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x12, 0x1})
eventfd2(0x5, 0x1)
ptrace(0x10, r2)
ptrace$ARCH_MAP_VDSO_64(0x1e, r2, 0x2, 0x2003)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x20000, 0x1, 0x288})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f})
write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x3, 0x200, 0x0, 0x0, 0xfffffffe, 0x4, 0x5, 0x0, 0x81, 0xfffffffd, 0x800, 0x32, 0x0, 0xfffffffe, 0x80000, 0x85, 0xfffffffd, 0x0, 0x9, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x409, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x4, 0x3, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffff, 0x0, 0x0, 0x9fa, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x925, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0xbda6, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x800, 0xfffeffe4, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x5, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x4, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r0, 0x5501)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in set_link_state
bisect: the chunk can be dropped
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 22]
detailed listing:
executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r3, 0xffffffffffffffff, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 22]
detailed listing:
executing program 0:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 22]
detailed listing:
executing program 0:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
r2 = ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 22]
detailed listing:
executing program 0:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 22]
detailed listing:
executing program 0:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r1, 0x1000006)
fcntl$addseals(r1, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 22]
detailed listing:
executing program 0:
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r0 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r0, 0x1000006)
fcntl$addseals(r0, 0x409, 0x7)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 22]
detailed listing:
executing program 0:
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r0 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r0, 0x1000006)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 22]
detailed listing:
executing program 0:
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 22]
detailed listing:
executing program 0:
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 22]
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 1:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)

program crashed: general protection fault in set_link_state
minimized 9 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 21]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r2 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2}, 0x50)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 20]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 19]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 18]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)
syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 17]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x9)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 16]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 15]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 14]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
mremap(&(0x7f0000674000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 13]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 12]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)
connect$inet(0xffffffffffffffff, 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
bind$bt_hci(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 9]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 8]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_emit_vhci(0x0, 0x7)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 7]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 6]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_usb_connect(0x3, 0x32, 0x0, 0x0)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4]
detailed listing:
executing program 1:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in dummy_udc_start
minimized 22 calls -> 4 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
bisect: concatenation succeeded
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program crashed: general protection fault in set_link_state
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./mysys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_hcd.0\x00', 0xb)

program crashed: general protection fault in set_link_state
validation run: crashed=true
reproducing took 54m11.531625835s
repro crashed as (corrupted=false):
usb usb5: USB disconnect, device number 1
usb 5-1: USB disconnect, device number 2
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 5 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5911 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:set_link_state+0x27/0xc70 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 18 e8 1a 3f 3b fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 35 0b 00 00 4c 8d ab a3 00 00 00 48 8b 2b 48 b8
RSP: 0018:ffffc90003c37b88 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cf4343
RDX: 0000000000000000 RSI: ffffffff87cf3466 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000293
R13: ffff888027968000 R14: 0000000000000000 R15: ffff888027968c00
FS:  00005555581e4500(0000) GS:ffff8880d5dec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005571eefa9168 CR3: 000000003be08000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 dummy_pullup+0xf3/0x170 drivers/usb/gadget/udc/dummy_hcd.c:933
 usb_gadget_disconnect_locked+0x142/0x4e0 drivers/usb/gadget/udc/core.c:785
 gadget_unbind_driver+0xd8/0x4f0 drivers/usb/gadget/udc/core.c:1718
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435
 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832
 driver_unregister+0x76/0xb0 drivers/base/driver.c:202
 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784
 raw_release+0x19b/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7891d9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd574545b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffd574546a0 RCX: 00007f7891d9e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000000da3d R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b31c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7892025fac R14: 00007f7892025fa8 R15: 00007f7892025fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:set_link_state+0x27/0xc70 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 18 e8 1a 3f 3b fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 35 0b 00 00 4c 8d ab a3 00 00 00 48 8b 2b 48 b8
RSP: 0018:ffffc90003c37b88 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cf4343
RDX: 0000000000000000 RSI: ffffffff87cf3466 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000293
R13: ffff888027968000 R14: 0000000000000000 R15: ffff888027968c00
FS:  00005555581e4500(0000) GS:ffff8880d5dec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005571eefa9168 CR3: 000000003be08000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	41 57                	push   %r15
   5:	41 56                	push   %r14
   7:	41 55                	push   %r13
   9:	41 54                	push   %r12
   b:	55                   	push   %rbp
   c:	53                   	push   %rbx
   d:	48 89 fb             	mov    %rdi,%rbx
  10:	48 83 ec 18          	sub    $0x18,%rsp
  14:	e8 1a 3f 3b fa       	call   0xfa3b3f33
  19:	48 89 da             	mov    %rbx,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 35 0b 00 00    	jne    0xb69
  34:	4c 8d ab a3 00 00 00 	lea    0xa3(%rbx),%r13
  3b:	48 8b 2b             	mov    (%rbx),%rbp
  3e:	48                   	rex.W
  3f:	b8                   	.byte 0xb8

final repro crashed as (corrupted=false):
usb usb5: USB disconnect, device number 1
usb 5-1: USB disconnect, device number 2
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 5 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5911 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:set_link_state+0x27/0xc70 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 18 e8 1a 3f 3b fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 35 0b 00 00 4c 8d ab a3 00 00 00 48 8b 2b 48 b8
RSP: 0018:ffffc90003c37b88 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cf4343
RDX: 0000000000000000 RSI: ffffffff87cf3466 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000293
R13: ffff888027968000 R14: 0000000000000000 R15: ffff888027968c00
FS:  00005555581e4500(0000) GS:ffff8880d5dec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005571eefa9168 CR3: 000000003be08000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 dummy_pullup+0xf3/0x170 drivers/usb/gadget/udc/dummy_hcd.c:933
 usb_gadget_disconnect_locked+0x142/0x4e0 drivers/usb/gadget/udc/core.c:785
 gadget_unbind_driver+0xd8/0x4f0 drivers/usb/gadget/udc/core.c:1718
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435
 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832
 driver_unregister+0x76/0xb0 drivers/base/driver.c:202
 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784
 raw_release+0x19b/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7891d9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd574545b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffd574546a0 RCX: 00007f7891d9e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000000da3d R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b31c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7892025fac R14: 00007f7892025fa8 R15: 00007f7892025fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:set_link_state+0x27/0xc70 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 18 e8 1a 3f 3b fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 35 0b 00 00 4c 8d ab a3 00 00 00 48 8b 2b 48 b8
RSP: 0018:ffffc90003c37b88 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cf4343
RDX: 0000000000000000 RSI: ffffffff87cf3466 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000293
R13: ffff888027968000 R14: 0000000000000000 R15: ffff888027968c00
FS:  00005555581e4500(0000) GS:ffff8880d5dec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005571eefa9168 CR3: 000000003be08000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	41 57                	push   %r15
   5:	41 56                	push   %r14
   7:	41 55                	push   %r13
   9:	41 54                	push   %r12
   b:	55                   	push   %rbp
   c:	53                   	push   %rbx
   d:	48 89 fb             	mov    %rdi,%rbx
  10:	48 83 ec 18          	sub    $0x18,%rsp
  14:	e8 1a 3f 3b fa       	call   0xfa3b3f33
  19:	48 89 da             	mov    %rbx,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 35 0b 00 00    	jne    0xb69
  34:	4c 8d ab a3 00 00 00 	lea    0xa3(%rbx),%r13
  3b:	48 8b 2b             	mov    (%rbx),%rbp
  3e:	48                   	rex.W
  3f:	b8                   	.byte 0xb8