Extracting prog: 4h18m21.641213937s
Minimizing prog: 31m59.083669507s
Simplifying prog options: 5m20.664123268s
Extracting C: 2m46.024139729s
Simplifying C: 0s


extracting reproducer from 32 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-openat-write-openat-write-openat-write-openat-write-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
single: failed to extract reproducer
bisect: bisecting 32 programs with base timeout 30s
testing program (duration=38s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 29, 2, 4, 25, 4, 18, 18, 2, 4, 21, 1, 10, 29, 13, 25, 22, 2, 15, 21, 23, 22, 15, 23, 8, 2, 2]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 2:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 0:
pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0)
executing program 1:
openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r1, 0x5)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x240000d4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
socket$inet6_tcp(0xa, 0x1, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 2:
ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x180940, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0)
ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = socket$inet6(0xa, 0x3, 0x3)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00'}, 0x18)
setrlimit(0x8, &(0x7f0000000080)={0x7, 0xd86000})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
unshare(0x400)
r5 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r2, 0x8)
r6 = accept4(r5, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e)
executing program 1:
socket$kcm(0x10, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fcntl$lock(0xffffffffffffffff, 0x24, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0)
executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c)
sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c)
socket(0x2, 0x80805, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r4, 0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x4, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x10, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000)
r3 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000340)="f4001100032b2c25fe8007000000007a2c08000000090000ff020000000000000000fffffff50000", 0x5dc}], 0x1}, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r4 = dup3(r1, r0, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r8=>0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0xc9, 0x0, &(0x7f0000000680)="f1a4f4b10f5bcb4501add85d3acacb5c46b400aa41b5f774e27319eb6906699b2cc9b5f30b6e8fac027b4bd92396d12ea915e94c8e03f5a887d24c96b3d8438019df2c0bb0a0c3fc8592d2575b1b99ba537f79897c06319a060982300a33fe7ddf83decd0f22b03e5d05a9f05e1ac281e23791859e186a5d421ef892806b9e20ade4cea7cb3e74d4bdba30c5755263024687fca6b7ef1c15694d4f0d9f6e481e367960520a07deddf0199b612b62f514f066eaa6632d5f7e9aeb981c5855fbe059b1224c8a255bae3e"})
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB='\b\x00\x00'], 0x24}}, 0x0)
sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x98, r7, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x62, 0xe, {{{}, {}, @broadcast, @broadcast, @random="ce99a8ba8228"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0xfff}, @val={0x5, 0x3, {0xb, 0x1f}}, @val={0x25, 0x3, {0x1, 0x34, 0x3}}, @void, @val={0x3c, 0x4, {0x0, 0x8f, 0x84, 0x2}}, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9}}, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7f}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x98}}, 0x20000014)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6)
r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4})
ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)
executing program 0:
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00')
pread64(r0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00')
readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r8, &(0x7f0000000000)='3', 0x4e)
mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0)
executing program 3:
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
shmctl$SHM_LOCK(0x0, 0xb)
syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e)
r3 = socket$rxrpc(0x21, 0x2, 0x0)
sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4)
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0)
socket$kcm(0x1e, 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10)
fstatfs(r4, &(0x7f00000002c0)=""/4096)
set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200)
executing program 3:
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0})
executing program 3:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350)
executing program 3:
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-openat-write-openat-write-openat-write-openat-write-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
single: failed to extract reproducer
bisect: bisecting 32 programs with base timeout 1m40s
testing program (duration=1m48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 29, 2, 4, 25, 4, 18, 18, 2, 4, 21, 1, 10, 29, 13, 25, 22, 2, 15, 21, 23, 22, 15, 23, 8, 2, 2]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 2:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 0:
pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0)
executing program 1:
openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r1, 0x5)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x240000d4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
socket$inet6_tcp(0xa, 0x1, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 2:
ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x180940, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0)
ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = socket$inet6(0xa, 0x3, 0x3)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00'}, 0x18)
setrlimit(0x8, &(0x7f0000000080)={0x7, 0xd86000})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
unshare(0x400)
r5 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r2, 0x8)
r6 = accept4(r5, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e)
executing program 1:
socket$kcm(0x10, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fcntl$lock(0xffffffffffffffff, 0x24, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0)
executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c)
sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c)
socket(0x2, 0x80805, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r4, 0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x4, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x10, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000)
r3 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000340)="f4001100032b2c25fe8007000000007a2c08000000090000ff020000000000000000fffffff50000", 0x5dc}], 0x1}, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r4 = dup3(r1, r0, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r8=>0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0xc9, 0x0, &(0x7f0000000680)="f1a4f4b10f5bcb4501add85d3acacb5c46b400aa41b5f774e27319eb6906699b2cc9b5f30b6e8fac027b4bd92396d12ea915e94c8e03f5a887d24c96b3d8438019df2c0bb0a0c3fc8592d2575b1b99ba537f79897c06319a060982300a33fe7ddf83decd0f22b03e5d05a9f05e1ac281e23791859e186a5d421ef892806b9e20ade4cea7cb3e74d4bdba30c5755263024687fca6b7ef1c15694d4f0d9f6e481e367960520a07deddf0199b612b62f514f066eaa6632d5f7e9aeb981c5855fbe059b1224c8a255bae3e"})
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB='\b\x00\x00'], 0x24}}, 0x0)
sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x98, r7, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x62, 0xe, {{{}, {}, @broadcast, @broadcast, @random="ce99a8ba8228"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0xfff}, @val={0x5, 0x3, {0xb, 0x1f}}, @val={0x25, 0x3, {0x1, 0x34, 0x3}}, @void, @val={0x3c, 0x4, {0x0, 0x8f, 0x84, 0x2}}, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9}}, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7f}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x98}}, 0x20000014)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6)
r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4})
ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)
executing program 0:
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00')
pread64(r0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00')
readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r8, &(0x7f0000000000)='3', 0x4e)
mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0)
executing program 3:
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
shmctl$SHM_LOCK(0x0, 0xb)
syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e)
r3 = socket$rxrpc(0x21, 0x2, 0x0)
sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4)
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0)
socket$kcm(0x1e, 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10)
fstatfs(r4, &(0x7f00000002c0)=""/4096)
set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200)
executing program 3:
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0})
executing program 3:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350)
executing program 3:
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-openat-write-openat-write-openat-write-openat-write-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
single: failed to extract reproducer
bisect: bisecting 32 programs with base timeout 6m0s
testing program (duration=6m8s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 29, 2, 4, 25, 4, 18, 18, 2, 4, 21, 1, 10, 29, 13, 25, 22, 2, 15, 21, 23, 22, 15, 23, 8, 2, 2]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 2:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 0:
pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0)
executing program 1:
openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r1, 0x5)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x240000d4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
socket$inet6_tcp(0xa, 0x1, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 2:
ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x180940, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0)
ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = socket$inet6(0xa, 0x3, 0x3)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00'}, 0x18)
setrlimit(0x8, &(0x7f0000000080)={0x7, 0xd86000})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
unshare(0x400)
r5 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r2, 0x8)
r6 = accept4(r5, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e)
executing program 1:
socket$kcm(0x10, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fcntl$lock(0xffffffffffffffff, 0x24, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0)
executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c)
sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c)
socket(0x2, 0x80805, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r4, 0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x4, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x10, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000)
r3 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000340)="f4001100032b2c25fe8007000000007a2c08000000090000ff020000000000000000fffffff50000", 0x5dc}], 0x1}, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r4 = dup3(r1, r0, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r8=>0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0xc9, 0x0, &(0x7f0000000680)="f1a4f4b10f5bcb4501add85d3acacb5c46b400aa41b5f774e27319eb6906699b2cc9b5f30b6e8fac027b4bd92396d12ea915e94c8e03f5a887d24c96b3d8438019df2c0bb0a0c3fc8592d2575b1b99ba537f79897c06319a060982300a33fe7ddf83decd0f22b03e5d05a9f05e1ac281e23791859e186a5d421ef892806b9e20ade4cea7cb3e74d4bdba30c5755263024687fca6b7ef1c15694d4f0d9f6e481e367960520a07deddf0199b612b62f514f066eaa6632d5f7e9aeb981c5855fbe059b1224c8a255bae3e"})
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB='\b\x00\x00'], 0x24}}, 0x0)
sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x98, r7, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x62, 0xe, {{{}, {}, @broadcast, @broadcast, @random="ce99a8ba8228"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0xfff}, @val={0x5, 0x3, {0xb, 0x1f}}, @val={0x25, 0x3, {0x1, 0x34, 0x3}}, @void, @val={0x3c, 0x4, {0x0, 0x8f, 0x84, 0x2}}, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9}}, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7f}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x98}}, 0x20000014)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6)
r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4})
ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)
executing program 0:
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00')
pread64(r0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00')
readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r8, &(0x7f0000000000)='3', 0x4e)
mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0)
executing program 3:
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
shmctl$SHM_LOCK(0x0, 0xb)
syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e)
r3 = socket$rxrpc(0x21, 0x2, 0x0)
sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4)
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0)
socket$kcm(0x1e, 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10)
fstatfs(r4, &(0x7f00000002c0)=""/4096)
set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200)
executing program 3:
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0})
executing program 3:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350)
executing program 3:
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: bisecting 32 programs
bisect: split chunks (needed=false): <31>
bisect: split chunk #0 of len 31 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 18, 2, 4, 21, 1, 10, 29, 13, 25, 22, 2, 15, 21, 23, 22, 15, 23, 8, 2, 2]
detailed listing:
executing program 1:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 2:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 0:
pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0)
executing program 1:
openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r1, 0x5)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x240000d4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
socket$inet6_tcp(0xa, 0x1, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
executing program 2:
ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x180940, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0)
ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = socket$inet6(0xa, 0x3, 0x3)
syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00'}, 0x18)
setrlimit(0x8, &(0x7f0000000080)={0x7, 0xd86000})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
unshare(0x400)
r5 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r2, 0x8)
r6 = accept4(r5, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e)
executing program 1:
socket$kcm(0x10, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fcntl$lock(0xffffffffffffffff, 0x24, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0)
executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c)
sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c)
socket(0x2, 0x80805, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r4, 0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x4, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x10, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000)
r3 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000340)="f4001100032b2c25fe8007000000007a2c08000000090000ff020000000000000000fffffff50000", 0x5dc}], 0x1}, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r4 = dup3(r1, r0, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r8=>0x0})
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0xc9, 0x0, &(0x7f0000000680)="f1a4f4b10f5bcb4501add85d3acacb5c46b400aa41b5f774e27319eb6906699b2cc9b5f30b6e8fac027b4bd92396d12ea915e94c8e03f5a887d24c96b3d8438019df2c0bb0a0c3fc8592d2575b1b99ba537f79897c06319a060982300a33fe7ddf83decd0f22b03e5d05a9f05e1ac281e23791859e186a5d421ef892806b9e20ade4cea7cb3e74d4bdba30c5755263024687fca6b7ef1c15694d4f0d9f6e481e367960520a07deddf0199b612b62f514f066eaa6632d5f7e9aeb981c5855fbe059b1224c8a255bae3e"})
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB='\b\x00\x00'], 0x24}}, 0x0)
sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x98, r7, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x62, 0xe, {{{}, {}, @broadcast, @broadcast, @random="ce99a8ba8228"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0xfff}, @val={0x5, 0x3, {0xb, 0x1f}}, @val={0x25, 0x3, {0x1, 0x34, 0x3}}, @void, @val={0x3c, 0x4, {0x0, 0x8f, 0x84, 0x2}}, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9}}, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7f}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x98}}, 0x20000014)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6)
r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4})
ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)
executing program 0:
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00')
pread64(r0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00')
readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r8, &(0x7f0000000000)='3', 0x4e)
mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0)
executing program 3:
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
shmctl$SHM_LOCK(0x0, 0xb)
syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e)
r3 = socket$rxrpc(0x21, 0x2, 0x0)
sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4)
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0)
socket$kcm(0x1e, 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10)
fstatfs(r4, &(0x7f00000002c0)=""/4096)
set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200)
executing program 3:
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0})
executing program 3:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350)
executing program 3:
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 29, 2, 4, 25, 4, 2, 15, 21, 23, 22, 15, 23, 8, 2, 2]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6)
r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4})
ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x401, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)
executing program 0:
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00')
pread64(r0, 0x0, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00')
readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r8, &(0x7f0000000000)='3', 0x4e)
mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0)
executing program 3:
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0)
shmctl$SHM_LOCK(0x0, 0xb)
syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e)
r3 = socket$rxrpc(0x21, 0x2, 0x0)
sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4)
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0)
socket$kcm(0x1e, 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10)
fstatfs(r4, &(0x7f00000002c0)=""/4096)
set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200)
executing program 3:
connect$can_bcm(0xffffffffffffffff, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0})
executing program 3:
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350)
executing program 3:
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 29, 2, 4, 25, 4, 23]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <11>
bisect: split chunk #0 of len 11 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 2, 4, 25, 4, 23]
detailed listing:
executing program 32:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 2:
r0 = gettid()
tkill(r0, 0x7)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558)
r1 = socket$inet6(0xa, 0x3, 0x3c)
writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2)
executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
ftruncate(r0, 0x5)
getpgid(0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7)
r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7})
ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1)
r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r5, &(0x7f0000000000)='7', 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48)
ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046})
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58)
listen(r0, 0x5)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 4, 27, 27, 21, 29, 23]
detailed listing:
executing program 4:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0)
close(r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'})
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r6 = socket(0x2, 0x80805, 0x0)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r7)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20)
sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
getpid()
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r4, &(0x7f0000000280)='select <kernelh\n', 0x10)
bind$bt_hci(r4, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448e1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0)
r5 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000100)=@llc={0x1a, 0x325, 0x8, 0x4, 0x3, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x18, 0x68000000}, 0x80fe)
r6 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r6, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x700, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5de}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x807e)
socket$kcm(0x21, 0x2, 0xa)
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <6>
bisect: split chunk #0 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 21, 29, 23]
detailed listing:
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 23]
detailed listing:
executing program 4:
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
fcntl$getflags(r0, 0x408)
sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"])
syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 21, 23]
detailed listing:
executing program 4:
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e)
setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0x168, 0x9, 0x230, 0xb, 0x320, 0x250, 0x250, 0x320, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0x208, 0x230, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@rt={{0x138}, {0x0, [0x4, 0x8], 0x6, 0x17, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @private2, @dev={0xfe, 0x80, '\x00', 0x38}, @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private0, @private2, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x26}], 0xe}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x2, 0x6, 0x4}, {0x3, 0x5, 0x1}}}}, {{@ipv6={@loopback, @mcast1, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x0, 0xff000000], 'gretap0\x00', 'bridge_slave_0\x00', {}, {}, 0x2b, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x3c2, 0x5fb8, 0x77, 'syz0\x00', {0x2b}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x17, &(0x7f00000007c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$netlink(0x10, 0x3, 0x15)
writev(r8, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 23]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb})
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)="0100000007003c52c6013d", 0xb)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r2, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r1, &(0x7f0000000000)='7', 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r1, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r1, &(0x7f0000000000)='7', 0x1)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r1, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(r1, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in corrupted
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 23]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 23]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='1:1', 0x3)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000840)='10', 0x2)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r8, &(0x7f0000000940)='128', 0x3)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r9, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)
write(r5, &(0x7f0000000500)='ppl', 0x3)

program did not crash
minimized 21 calls -> 9 calls
minimizing program #1 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 22]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='128', 0x3)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r8, &(0x7f00000009c0)='1', 0x1)
write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 21]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='128', 0x3)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)
write(r8, &(0x7f00000009c0)='1', 0x1)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 20]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 19]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
write(r7, &(0x7f0000000940)='128', 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 19]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 19]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(r6, &(0x7f0000000840)='10', 0x2)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 18]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 17]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='1:1', 0x3)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 16]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 15]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 14]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='65536', 0x5)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 12]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='2', 0x1)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 11]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 10]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='raid5', 0x5)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 9]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external', 0x8)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 7]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 6]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 5]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 4]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 3]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 2]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
minimized 23 calls -> 2 calls
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev-openat$cgroup-bpf$PROG_LOAD-getsockopt$inet_sctp_SCTP_RESET_STREAMS-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
bisect: concatenation succeeded
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev-openat$cgroup-bpf$PROG_LOAD-getsockopt$inet_sctp_SCTP_RESET_STREAMS-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='128', 0x3)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev-openat$cgroup-bpf$PROG_LOAD-getsockopt$inet_sctp_SCTP_RESET_STREAMS
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)={0x0, 0x7}, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev-openat$cgroup-bpf$PROG_LOAD
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev-openat$cgroup
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-syz_open_dev$evdev
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, 0x0, &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200), 0x0)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m43.282722938s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
program did not crash
simplifying guilty program options
testing program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
extracting C reproducer
testing compiled C program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
program did not crash
testing program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
validation run: crashed=true
testing program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
validation run: crashed=true
testing program (duration=1m43.282722938s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./gadget\x00', 0x28)
mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff0000000705810200020012010002000000402505a0a4000100000001", 0x48)
openat(0xffffffffffffff9c, &(0x7f00000005c0)='./gadget/ep1in-bulk\x00', 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in ep_open
validation run: crashed=true
reproducing took 5h1m25.351190364s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821
Read of s
Read of size 8 at addr ffff888059633058 by task syz.1.78/6012

CPU: 1 UID: 0 PID: 6012 Comm: syz.1.78 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 __mutex_lock_common kernel/locking/mutex.c:625 [inline]
 __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821
 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd31ff9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc6586dfd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fd320225fa0 RCX: 00007fd31ff9e159
RDX: 0000000000000002 RSI: 00002000000005c0 RDI: ffffffffffffff9c
RBP: 00007fd32003506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd320225fac R14: 00007fd320225fa0 R15: 00007fd320225fa0
 </TASK>

Allocated by task 6011:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 activate_ep_files drivers/usb/gadget/legacy/inode.c:1611 [inline]
 gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1702
 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752
 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1893
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6011:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6801
 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline]
 put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217
 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1592
 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1665
 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435
 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832
 driver_unregister+0x76/0xb0 drivers/base/driver.c:202
 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784
 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888059633000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 88 bytes inside of
 freed 512-byte region [ffff888059633000, ffff888059633200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59630
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c02fc80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c02fc80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5693, tgid 5693 (syz-executor), ts 69257866756
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 rxrpc_alloc_peer+0xa7/0x400 net/rxrpc/peer_object.c:229
 rxrpc_service_prealloc_one+0xc5e/0x1040 net/rxrpc/call_accept.c:73
 rxrpc_kernel_charge_accept+0xdd/0x120 net/rxrpc/call_accept.c:489
 afs_charge_preallocation+0xd8/0x360 fs/afs/rxrpc.c:766
 afs_open_socket+0x31e/0x3f0 fs/afs/rxrpc.c:112
 afs_net_init+0x825/0xb00 fs/afs/main.c:116
 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
 setup_net+0x118/0x3a0 net/core/net_namespace.c:443
 copy_net_ns+0x345/0x7a0 net/core/net_namespace.c:582
page last free pid 5685 tgid 5685 ts 69251461790 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x586/0xe00 mm/page_alloc.c:1463
 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x12a/0x200 mm/page_alloc.c:5322
 vm_area_free_pages+0xb2/0x2a0 mm/vmalloc.c:3461
 vfree mm/vmalloc.c:3510 [inline]
 vfree+0xf7/0x6d0 mm/vmalloc.c:3484
 vfree mm/vmalloc.c:3511 [inline]
 vfree+0x11d/0x6d0 mm/vmalloc.c:3484
 kcov_put kernel/kcov.c:449 [inline]
 kcov_put kernel/kcov.c:445 [inline]
 kcov_close+0x34/0x60 kernel/kcov.c:556
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x951/0x2ae0 kernel/exit.c:1011
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1154
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3051
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888059632f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888059632f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888059633000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888059633080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888059633100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821
Read of s
Read of size 8 at addr ffff888059633058 by task syz.1.78/6012

CPU: 1 UID: 0 PID: 6012 Comm: syz.1.78 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 __mutex_lock_common kernel/locking/mutex.c:625 [inline]
 __mutex_lock+0x15c5/0x1bd0 kernel/locking/mutex.c:821
 ep_open+0x4c/0x2c0 drivers/usb/gadget/legacy/inode.c:832
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd31ff9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc6586dfd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fd320225fa0 RCX: 00007fd31ff9e159
RDX: 0000000000000002 RSI: 00002000000005c0 RDI: ffffffffffffff9c
RBP: 00007fd32003506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd320225fac R14: 00007fd320225fa0 R15: 00007fd320225fa0
 </TASK>

Allocated by task 6011:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 activate_ep_files drivers/usb/gadget/legacy/inode.c:1611 [inline]
 gadgetfs_bind+0x582/0x890 drivers/usb/gadget/legacy/inode.c:1702
 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
 driver_register+0x1e2/0x360 drivers/base/driver.c:174
 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752
 dev_config+0xdce/0x1610 drivers/usb/gadget/legacy/inode.c:1893
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6011:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6801
 put_ep drivers/usb/gadget/legacy/inode.c:225 [inline]
 put_ep+0x117/0x150 drivers/usb/gadget/legacy/inode.c:217
 destroy_ep_files+0x163/0x420 drivers/usb/gadget/legacy/inode.c:1592
 gadgetfs_unbind+0x139/0x260 drivers/usb/gadget/legacy/inode.c:1665
 gadget_unbind_driver+0x20c/0x4f0 drivers/usb/gadget/udc/core.c:1724
 device_remove+0xcb/0x180 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
 driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435
 bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832
 driver_unregister+0x76/0xb0 drivers/base/driver.c:202
 usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784
 dev_release+0x132/0x1b0 drivers/usb/gadget/legacy/inode.c:1207
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888059633000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 88 bytes inside of
 freed 512-byte region [ffff888059633000, ffff888059633200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59630
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c02fc80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c02fc80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5693, tgid 5693 (syz-executor), ts 69257866756
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 rxrpc_alloc_peer+0xa7/0x400 net/rxrpc/peer_object.c:229
 rxrpc_service_prealloc_one+0xc5e/0x1040 net/rxrpc/call_accept.c:73
 rxrpc_kernel_charge_accept+0xdd/0x120 net/rxrpc/call_accept.c:489
 afs_charge_preallocation+0xd8/0x360 fs/afs/rxrpc.c:766
 afs_open_socket+0x31e/0x3f0 fs/afs/rxrpc.c:112
 afs_net_init+0x825/0xb00 fs/afs/main.c:116
 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
 setup_net+0x118/0x3a0 net/core/net_namespace.c:443
 copy_net_ns+0x345/0x7a0 net/core/net_namespace.c:582
page last free pid 5685 tgid 5685 ts 69251461790 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x586/0xe00 mm/page_alloc.c:1463
 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:7072
 __free_contig_range mm/page_alloc.c:7117 [inline]
 free_pages_bulk+0x12a/0x200 mm/page_alloc.c:5322
 vm_area_free_pages+0xb2/0x2a0 mm/vmalloc.c:3461
 vfree mm/vmalloc.c:3510 [inline]
 vfree+0xf7/0x6d0 mm/vmalloc.c:3484
 vfree mm/vmalloc.c:3511 [inline]
 vfree+0x11d/0x6d0 mm/vmalloc.c:3484
 kcov_put kernel/kcov.c:449 [inline]
 kcov_put kernel/kcov.c:445 [inline]
 kcov_close+0x34/0x60 kernel/kcov.c:556
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x951/0x2ae0 kernel/exit.c:1011
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1154
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3051
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888059632f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888059632f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888059633000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888059633080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888059633100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================