Extracting prog: 41m21.066135422s
Minimizing prog: 14m42.643837113s
Simplifying prog options: 0s
Extracting C: 49.913800312s
Simplifying C: 10m35.711592114s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 2, 6, 6, 22, 14, 4, 4, 7, 21, 3, 6, 11, 20, 6, 12, 14, 21, 12, 2, 6, 9, 21, 4, 4, 6, 3, 3, 20, 6]
detailed listing:
executing program 3:
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x21, 0xfffffffffffffffe, 0x10)
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd7001bedbdf25340000000800b8"], 0x3c}, 0x1, 0x0, 0x0, 0x200080d4}, 0x20000000)
msgget$private(0x0, 0x41)
msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xdd, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x200})
msgsnd(0x0, &(0x7f0000000080)={0x3}, 0x8, 0x0)
msgctl$IPC_RMID(0x0, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e700008000040905", @ANYBLOB="b70795"], 0x0)
syz_open_dev$evdev(&(0x7f0000000180), 0x4cc6, 0x2)
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/253], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 2:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
executing program 0:
r0 = epoll_create(0x3)
r1 = openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x0, 0x2000000})
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r4 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r4, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
pread64(r0, 0x0, 0x0, 0x8001)
executing program 2:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r1 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
executing program 3:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x0, 0x210, 0x0, 0x0}, {0x3, 0xd611, 0x94, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef7"}, {0x29d, 0x1000, 0x0, 0x0}], 0x3})
executing program 2:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a0000080480020009", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 0:
r0 = epoll_create1(0x80000)
epoll_pwait(r0, &(0x7f0000000380)=[{}], 0x1, 0x1ff, 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xf5, &(0x7f0000000740))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
read$FUSE(0xffffffffffffffff, &(0x7f0000000780)={0x2020}, 0x2020)
timer_settime(0x0, 0x0, 0x0, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x800000, 0x48)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x44, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1e, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008081}, 0x24044040)
executing program 1:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/253], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0xf)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff1}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008014}, 0x40000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x68040200)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'})
gettid()
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084)
executing program 3:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x123e00, 0x0)
r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000280)=<r2=>0x0, &(0x7f0000000300)=<r3=>0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x1)
r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2)
r6 = memfd_create(&(0x7f0000000780)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r6, 0xffff)
fcntl$addseals(r6, 0x409, 0x3)
close(0x3)
r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000940)={r6, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r7, 0x40046201, &(0x7f0000000980)='log\x00')
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0)
r8 = socket$igmp6(0xa, 0x3, 0x2)
syz_emit_vhci(&(0x7f0000000180)=ANY=[], 0x7)
getsockopt$MRT6(r8, 0x29, 0xcf, 0x0, 0x0)
syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, <r9=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x7, 0xe26, 0x0, 0x0, 0x1000, 0x10000}}}, &(0x7f0000000480)=<r10=>0x0)
r11 = socket$inet6_tcp(0xa, 0x1, 0x0)
r12 = dup(r11)
syz_ublk_setup_queues(r12, r10, &(0x7f0000000400)={0x0, 0x75a2, 0x800, 0x1, 0x44}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7efffe, 0x8, 0x1006, 0x428d, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x400, 0x3, 0xffffffff, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x871629fa8e454127, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r9, '\x00', {0xfff5, 0x8a4, 0x0, 0x0}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94)
executing program 2:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, 0x0}], 0x1, 0x45, 0x0, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000740)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]})
r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 4:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r1 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
executing program 4:
r0 = epoll_create(0x3)
r1 = openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x0, 0x2000000})
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r3 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r3, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
pread64(r0, 0x0, 0x0, 0x8001)
executing program 2:
syz_open_dev$media(&(0x7f00000000c0), 0x13, 0x200)
syz_open_dev$media(&(0x7f0000000300), 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119)
r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000280)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=<r5=>0x0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = dup(r6)
syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1ee, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffffee, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8534, 0x80, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x0, 0x0, 0x0}}, 0x0)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e74000905"], 0x0)
syz_open_dev$midi(&(0x7f00000000c0), 0x3, 0x4ae41)
executing program 3:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0)
r1 = syz_open_dev$I2C(0x0, 0x1, 0x2703)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x0, 0xfe, 0x4, &(0x7f0000000080)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}})
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x474c, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x300)
sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000100)=0x80, 0x4)
setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000140)=0x3, 0x4)
recvmmsg(r0, &(0x7f0000000180), 0x291962b, 0x45833af92e4b39ff, 0x0)
executing program 1:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})
executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000f00), 0x2982, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000f40)='/proc/schedstat\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x20000023896)
executing program 3:
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
getresuid(&(0x7f0000000380), &(0x7f0000000540), 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0)
connect$inet6(r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00'})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={@multicast2, 0x1, 0x0, 0x30, 0x0, [{@initdev}, {@dev}, {@broadcast}]}})
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8000002)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
executing program 4:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 2, 6, 6, 22, 14, 4, 4, 7, 21, 3, 6, 11, 20, 6, 12, 14, 21, 12, 2, 6, 9, 21, 4, 4, 6, 3, 3, 20, 6]
detailed listing:
executing program 3:
unshare(0x22020600)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x21, 0xfffffffffffffffe, 0x10)
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd7001bedbdf25340000000800b8"], 0x3c}, 0x1, 0x0, 0x0, 0x200080d4}, 0x20000000)
msgget$private(0x0, 0x41)
msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xdd, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x200})
msgsnd(0x0, &(0x7f0000000080)={0x3}, 0x8, 0x0)
msgctl$IPC_RMID(0x0, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e700008000040905", @ANYBLOB="b70795"], 0x0)
syz_open_dev$evdev(&(0x7f0000000180), 0x4cc6, 0x2)
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/253], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 2:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
executing program 0:
r0 = epoll_create(0x3)
r1 = openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x0, 0x2000000})
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0)
sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r4 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r4, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
pread64(r0, 0x0, 0x0, 0x8001)
executing program 2:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r1 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
executing program 3:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x0, 0x210, 0x0, 0x0}, {0x3, 0xd611, 0x94, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef7"}, {0x29d, 0x1000, 0x0, 0x0}], 0x3})
executing program 2:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a0000080480020009", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 0:
r0 = epoll_create1(0x80000)
epoll_pwait(r0, &(0x7f0000000380)=[{}], 0x1, 0x1ff, 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xf5, &(0x7f0000000740))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
read$FUSE(0xffffffffffffffff, &(0x7f0000000780)={0x2020}, 0x2020)
timer_settime(0x0, 0x0, 0x0, 0x0)
executing program 0:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x800000, 0x48)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x44, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1e, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008081}, 0x24044040)
executing program 1:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/253], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0xf)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff1}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008014}, 0x40000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x68040200)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'})
gettid()
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084)
executing program 3:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x123e00, 0x0)
r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000280)=<r2=>0x0, &(0x7f0000000300)=<r3=>0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x1)
r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2)
r6 = memfd_create(&(0x7f0000000780)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r6, 0xffff)
fcntl$addseals(r6, 0x409, 0x3)
close(0x3)
r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000940)={r6, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r7, 0x40046201, &(0x7f0000000980)='log\x00')
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0)
r8 = socket$igmp6(0xa, 0x3, 0x2)
syz_emit_vhci(&(0x7f0000000180)=ANY=[], 0x7)
getsockopt$MRT6(r8, 0x29, 0xcf, 0x0, 0x0)
syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, <r9=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x7, 0xe26, 0x0, 0x0, 0x1000, 0x10000}}}, &(0x7f0000000480)=<r10=>0x0)
r11 = socket$inet6_tcp(0xa, 0x1, 0x0)
r12 = dup(r11)
syz_ublk_setup_queues(r12, r10, &(0x7f0000000400)={0x0, 0x75a2, 0x800, 0x1, 0x44}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7efffe, 0x8, 0x1006, 0x428d, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x400, 0x3, 0xffffffff, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x871629fa8e454127, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r9, '\x00', {0xfff5, 0x8a4, 0x0, 0x0}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94)
executing program 2:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, 0x0}], 0x1, 0x45, 0x0, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000740)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]})
r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 4:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r1 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
executing program 4:
r0 = epoll_create(0x3)
r1 = openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x0, 0x2000000})
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r3 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r3, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
pread64(r0, 0x0, 0x0, 0x8001)
executing program 2:
syz_open_dev$media(&(0x7f00000000c0), 0x13, 0x200)
syz_open_dev$media(&(0x7f0000000300), 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119)
r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000280)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=<r5=>0x0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = dup(r6)
syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1ee, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffffee, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8534, 0x80, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x0, 0x0, 0x0}}, 0x0)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e74000905"], 0x0)
syz_open_dev$midi(&(0x7f00000000c0), 0x3, 0x4ae41)
executing program 3:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0)
r1 = syz_open_dev$I2C(0x0, 0x1, 0x2703)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x0, 0xfe, 0x4, &(0x7f0000000080)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}})
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x474c, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x300)
sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000100)=0x80, 0x4)
setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000140)=0x3, 0x4)
recvmmsg(r0, &(0x7f0000000180), 0x291962b, 0x45833af92e4b39ff, 0x0)
executing program 1:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})
executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000f00), 0x2982, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000f40)='/proc/schedstat\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x20000023896)
executing program 3:
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
getresuid(&(0x7f0000000380), &(0x7f0000000540), 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0)
connect$inet6(r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00'})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={@multicast2, 0x1, 0x0, 0x30, 0x0, [{@initdev}, {@dev}, {@broadcast}]}})
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8000002)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
executing program 4:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <29>
bisect: split chunk #0 of len 29 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 11, 20, 6, 12, 14, 21, 12, 2, 6, 9, 21, 4, 4, 6, 3, 3, 20, 6]
detailed listing:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x800000, 0x48)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x44, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1e, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008081}, 0x24044040)
executing program 1:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/253], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0xf)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff1}, {0xffff, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008014}, 0x40000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x68040200)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00'})
gettid()
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084)
executing program 3:
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x123e00, 0x0)
r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000280)=<r2=>0x0, &(0x7f0000000300)=<r3=>0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x1)
r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2)
r6 = memfd_create(&(0x7f0000000780)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
ftruncate(r6, 0xffff)
fcntl$addseals(r6, 0x409, 0x3)
close(0x3)
r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000940)={r6, 0x1, 0x0, 0x2000})
ioctl$DMA_BUF_SET_NAME_A(r7, 0x40046201, &(0x7f0000000980)='log\x00')
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0)
r8 = socket$igmp6(0xa, 0x3, 0x2)
syz_emit_vhci(&(0x7f0000000180)=ANY=[], 0x7)
getsockopt$MRT6(r8, 0x29, 0xcf, 0x0, 0x0)
syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, <r9=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x7, 0xe26, 0x0, 0x0, 0x1000, 0x10000}}}, &(0x7f0000000480)=<r10=>0x0)
r11 = socket$inet6_tcp(0xa, 0x1, 0x0)
r12 = dup(r11)
syz_ublk_setup_queues(r12, r10, &(0x7f0000000400)={0x0, 0x75a2, 0x800, 0x1, 0x44}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7efffe, 0x8, 0x1006, 0x428d, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x400, 0x3, 0xffffffff, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x871629fa8e454127, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r9, '\x00', {0xfff5, 0x8a4, 0x0, 0x0}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94)
executing program 2:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, 0x0}], 0x1, 0x45, 0x0, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000740)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]})
r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 4:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r1 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
executing program 4:
r0 = epoll_create(0x3)
r1 = openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x0, 0x2000000})
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
r3 = socket$inet(0x2, 0x3, 0x4)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0)
setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10)
sendmmsg$inet(r3, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0)
pread64(r0, 0x0, 0x0, 0x8001)
executing program 2:
syz_open_dev$media(&(0x7f00000000c0), 0x13, 0x200)
syz_open_dev$media(&(0x7f0000000300), 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119)
r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000280)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=<r5=>0x0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = dup(r6)
syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1ee, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffffee, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8534, 0x80, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x0, 0x0, 0x0}}, 0x0)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94)
executing program 4:
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e74000905"], 0x0)
syz_open_dev$midi(&(0x7f00000000c0), 0x3, 0x4ae41)
executing program 3:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0)
r1 = syz_open_dev$I2C(0x0, 0x1, 0x2703)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x0, 0xfe, 0x4, &(0x7f0000000080)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}})
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x474c, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x300)
sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000100)=0x80, 0x4)
setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000140)=0x3, 0x4)
recvmmsg(r0, &(0x7f0000000180), 0x291962b, 0x45833af92e4b39ff, 0x0)
executing program 1:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})
executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000f00), 0x2982, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000f40)='/proc/schedstat\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x20000023896)
executing program 3:
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
getresuid(&(0x7f0000000380), &(0x7f0000000540), 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0)
connect$inet6(r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00'})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={@multicast2, 0x1, 0x0, 0x30, 0x0, [{@initdev}, {@dev}, {@broadcast}]}})
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8000002)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
executing program 4:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 9, 21, 4, 4, 6, 3, 3, 20, 6]
detailed listing:
executing program 3:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0)
r1 = syz_open_dev$I2C(0x0, 0x1, 0x2703)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x0, 0xfe, 0x4, &(0x7f0000000080)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}})
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x474c, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x300)
sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000100)=0x80, 0x4)
setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000140)=0x3, 0x4)
recvmmsg(r0, &(0x7f0000000180), 0x291962b, 0x45833af92e4b39ff, 0x0)
executing program 1:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})
executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000f00), 0x2982, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000f40)='/proc/schedstat\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x20000023896)
executing program 3:
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
getresuid(&(0x7f0000000380), &(0x7f0000000540), 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0)
connect$inet6(r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00'})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={@multicast2, 0x1, 0x0, 0x30, 0x0, [{@initdev}, {@dev}, {@broadcast}]}})
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8000002)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
executing program 4:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
bisect: split chunks (needed=true): <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 3, 20, 6]
detailed listing:
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100"/257], 0x119)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000)
r1 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042)
r2 = dup3(r1, r0, 0x80000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})
executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000f00), 0x2982, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000f40)='/proc/schedstat\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x20000023896)
executing program 3:
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
getresuid(&(0x7f0000000380), &(0x7f0000000540), 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0)
connect$inet6(r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00'})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={@multicast2, 0x1, 0x0, 0x30, 0x0, [{@initdev}, {@dev}, {@broadcast}]}})
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8000002)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x80002, 0x0)
executing program 4:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
unshare(0x2c020400)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 9, 21, 4, 4, 3]
detailed listing:
executing program 3:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0)
r1 = syz_open_dev$I2C(0x0, 0x1, 0x2703)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x0, 0xfe, 0x4, &(0x7f0000000080)={0x6, "b3d92cdddf96c20e9064264ccfc6000000fa00008c0000c87fb100000000000100"}})
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x474c, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x2, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x300)
sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000100)=0x80, 0x4)
setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000140)=0x3, 0x4)
recvmmsg(r0, &(0x7f0000000180), 0x291962b, 0x45833af92e4b39ff, 0x0)
executing program 1:
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000500)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x0, 0x0, 0x1000002}})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
munlockall()
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
socket(0x10, 0x3, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test\x00', 0x777)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='10000', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000180)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280))
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 3]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYBLOB="f7", @ANYRESDEC], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
writev(r1, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000180)="5ae9", 0x2}], 0x2)
syz_usb_disconnect(r0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 2:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x3, 0xd611, 0x95, &(0x7f00000002c0)="75bd733862ce052511c59b49072256720abd1814738bd46962e0133f4a6aca72363e86a604ed6df1ed40d414313d2f37be59b3f7e738e2e44a42a3d18c97d4cc401929382e66d6999d7067183cad8b7e743c5481d5ed2c4c5db8605722027193048d67d33c2276af3f5d0a72f1367fba948c446ce0cb621b79349e63e6fffa95d072454f9964921c426b4e8d86655adb724a9ef784"}, {0x29d, 0x1000, 0x0, 0x0}], 0x2})
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x2603)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 3]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}}, 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3]
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3]
detailed listing:
executing program 0:
executing program 1:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
minimized 4 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 2:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
executing program 0:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 2:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
executing program 0:
syz_usb_connect(0x2, 0x9a2, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0)
ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 2:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
executing program 0:
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
minimized 3 calls -> 2 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, 0x0, 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(0x0, 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, 0x0)

program did not crash
testing program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=1m21.452110366s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program did not crash
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing compiled C program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
testing program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
testing program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
testing program (duration=1m21.452110366s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$I2C-ioctl$I2C_RDWR
detailed listing:
executing program 0:
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000b40), 0x1, 0x402)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000d80)={&(0x7f0000000dc0)=[{0x50, 0x8001, 0x0, 0x0}], 0x1})

program crashed: WARNING in gl861_ctrl_msg/usb_submit_urb
validation run: crashed=true
reproducing took 1h12m20.715833317s
repro crashed as (corrupted=false):
WARNING: CPU: 1 PID: 4560 at drivers/usb/core/urb.c:413 usb_submit_urb+0x1178/0x18d0 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 1 PID: 4560 Comm: syz.1.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:usb_submit_urb+0x1178/0x18d0 drivers/usb/core/urb.c:411
Code: df 0f b6 44 05 00 84 c0 0f 85 5e 06 00 00 45 0f b6 45 00 48 c7 c7 a0 11 4f 8b 48 8b 74 24 08 4c 89 e2 44 89 f1 e8 c8 16 21 fb <0f> 0b 49 bf 00 00 00 00 00 fc ff df e9 b3 f3 ff ff 89 e9 80 e1 07
RSP: 0018:ffffc900037877d8 EFLAGS: 00010246
RAX: c818a5c7848e6400 RBX: ffff88807bf48d00 RCX: ffff88802f80da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100bed4fa9 R08: ffffc90003787467 R09: 1ffff920006f0e8c
R10: dffffc0000000000 R11: fffff520006f0e8d R12: ffff88801ded77a8
R13: ffff88805f6a7d48 R14: 0000000080000880 R15: dffffc0000000000
FS:  000055555de3c500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa845271220 CR3: 00000000631d4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_start_wait_urb+0x13c/0x580 drivers/usb/core/message.c:61
 usb_internal_control_msg drivers/usb/core/message.c:116 [inline]
 usb_control_msg+0x231/0x3e0 drivers/usb/core/message.c:166
 gl861_ctrl_msg+0x211/0x3d0 drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x430/0x640 drivers/media/usb/dvb-usb-v2/gl861.c:-1
 __i2c_transfer+0x88d/0x2290 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x25d/0x3a0 drivers/i2c/i2c-core-base.c:2366
 i2cdev_ioctl_rdwr+0x3dc/0x6c0 drivers/i2c/i2c-dev.c:297
 i2cdev_ioctl+0x610/0x7b0 drivers/i2c/i2c-dev.c:458
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa84539f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4d29abc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa845625fa0 RCX: 00007fa84539f559
RDX: 0000200000000d80 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007fa845436b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa845625fac R14: 00007fa845625fa0 R15: 00007fa845625fa0
 </TASK>

final repro crashed as (corrupted=false):
WARNING: CPU: 1 PID: 4560 at drivers/usb/core/urb.c:413 usb_submit_urb+0x1178/0x18d0 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 1 PID: 4560 Comm: syz.1.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:usb_submit_urb+0x1178/0x18d0 drivers/usb/core/urb.c:411
Code: df 0f b6 44 05 00 84 c0 0f 85 5e 06 00 00 45 0f b6 45 00 48 c7 c7 a0 11 4f 8b 48 8b 74 24 08 4c 89 e2 44 89 f1 e8 c8 16 21 fb <0f> 0b 49 bf 00 00 00 00 00 fc ff df e9 b3 f3 ff ff 89 e9 80 e1 07
RSP: 0018:ffffc900037877d8 EFLAGS: 00010246
RAX: c818a5c7848e6400 RBX: ffff88807bf48d00 RCX: ffff88802f80da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100bed4fa9 R08: ffffc90003787467 R09: 1ffff920006f0e8c
R10: dffffc0000000000 R11: fffff520006f0e8d R12: ffff88801ded77a8
R13: ffff88805f6a7d48 R14: 0000000080000880 R15: dffffc0000000000
FS:  000055555de3c500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa845271220 CR3: 00000000631d4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_start_wait_urb+0x13c/0x580 drivers/usb/core/message.c:61
 usb_internal_control_msg drivers/usb/core/message.c:116 [inline]
 usb_control_msg+0x231/0x3e0 drivers/usb/core/message.c:166
 gl861_ctrl_msg+0x211/0x3d0 drivers/media/usb/dvb-usb-v2/gl861.c:58
 gl861_i2c_master_xfer+0x430/0x640 drivers/media/usb/dvb-usb-v2/gl861.c:-1
 __i2c_transfer+0x88d/0x2290 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x25d/0x3a0 drivers/i2c/i2c-core-base.c:2366
 i2cdev_ioctl_rdwr+0x3dc/0x6c0 drivers/i2c/i2c-dev.c:297
 i2cdev_ioctl+0x610/0x7b0 drivers/i2c/i2c-dev.c:458
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa84539f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4d29abc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa845625fa0 RCX: 00007fa84539f559
RDX: 0000200000000d80 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007fa845436b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa845625fac R14: 00007fa845625fa0 R15: 00007fa845625fa0
 </TASK>