Extracting prog: 12h10m30.969908194s
Minimizing prog: 2h42m26.74357104s
Simplifying prog options: 0s
Extracting C: 1m30.262086062s
Simplifying C: 10m57.223275248s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-mkdirat-openat-write-mkdirat-mkdirat-openat-write-openat-write-symlinkat-openat-write-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-ioctl$USBDEVFS_CONTROL-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-mkdirat-openat-write-mkdirat-mkdirat-openat-write-openat-write-symlinkat-openat-write-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-ioctl$USBDEVFS_CONTROL-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 1m40s
testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <23>
bisect: split chunk #0 of len 23 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 24]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)

program did not crash
bisect: split chunks (needed=true): <8>, <8>, <7>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: split chunk #1 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: split chunk #2 of len 7 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)

program did not crash
bisect: split chunks (needed=true): <4>, <4>, <4>, <4>, <4>, <3>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 20, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRIN', 0x8)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in nvmet_fc_remove_port
bisect: the chunk can be dropped
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: split chunk #2 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 20, 4, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 6, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: split chunk #3 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 20, 4, 14, 14, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 21, 25, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)='tcp\n', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r5, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r6, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: split chunk #4 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 4, 24, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000480)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='tcp\n', 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='ipv4\n', 0x5)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r8, &(0x7f00000006c0)='4420\n', 0x5)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r9 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r9, &(0x7f00000007c0)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=testsubsys\n', 0x3b)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r10, &(0x7f0000000840)='0\n', 0x2)
nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./dev/nvme0n1\x00', 0x2, 0x0)
pwrite64(r11, &(0x7f0000001000)='\x00'/16384, 0x4000, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r5, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r5)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
write$char_usb(r3, &(0x7f0000000540)='TESTPRINTERD', 0xc)
read(r4, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
read(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f0000000480)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000580)='fc\n', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='fc\n', 0x3)
close(r2)
write(0xffffffffffffffff, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(0xffffffffffffffff)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
close(0xffffffffffffffff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r4)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 27, 6, 24, 32, 4, 25, 20, 4, 6, 4, 14, 14, 21, 25, 24, 6, 24, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
close(r5)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r6, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x83)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234

<<cut 359851 bytes out>>

00000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r3, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 16, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 16, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280), 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14, 24, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
minimized 20 calls -> 15 calls
minimizing program #2 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 23, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 23, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in corrupted
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 22, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 22, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000540))
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 22, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 22, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 21, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 21, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
write(r5, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 21, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 21, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
write(r3, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
write(r3, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
write(r3, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 20, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
write(r3, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 19, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
write(r3, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 18, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000540))
write(r2, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 18, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r3 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000540))
write(r2, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 17, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in corrupted
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 15, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 15, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 15, 24, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 0:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
unlinkat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00', 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
minimized 24 calls -> 16 calls
minimizing program #3 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 23, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000580)={0xa1, 0x1, 0x100, 0x0, 0x8, 0x32, &(0x7f00000005c0)})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 22, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r6 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000540))
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 21, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 20, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 19, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 18, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 18, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 18, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 17, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 16, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 15, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 15, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 14, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 13, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='1234\n', 0x5)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 12, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 11, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 10, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 9, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in corrupted
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 8, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0x1234\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 7, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 6, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 5, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 4]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 0:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)
write(r0, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
minimized 24 calls -> 4 calls
minimizing program #4 before concatenation
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 3]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 3]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING: refcount bug in cdev_put
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 2]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15, 16, 4, 2]
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r1, &(0x7f0000000580)=""/1, 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000540))
write(r1, &(0x7f0000000600)='\n', 0x1)
executing program 1:
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
executing program 0:
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
minimized 4 calls -> 3 calls
testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-openat-write-mkdirat-mount-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
bisect: concatenation succeeded
found reproducer with 40 syscalls
minimizing guilty program
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-openat-write-mkdirat-mount
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-openat-write-mkdirat-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-openat-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-write-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-write-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r5 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000540))
write(r4, &(0x7f0000000600)='\n', 0x1)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r6, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_DISCONNECT_CLAIM-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000000540))
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-syz_open_dev$usbfs-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
syz_open_dev$usbfs(&(0x7f0000000500), 0x15, 0x2)
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-nanosleep-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
nanosleep(&(0x7f00000004f0)={0x0, 0xbebc200}, 0x0)
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-openat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r5, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: BUG: corrupted list in cd_forget
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-write-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='8\n', 0x2)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r4, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-openat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-write-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
write(0xffffffffffffffff, &(0x7f0000000240)='1234\n', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-write-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000180)='0x5678\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mount-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-read-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
read(r2, &(0x7f0000000580)=""/1, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-openat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/usb/lp0\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-openat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/g_printer0\x00', 0x802, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-nanosleep-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
nanosleep(&(0x7f00000004c0)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-write-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='dummy_udc.0', 0xb)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-openat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-symlinkat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-write-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='0xa4a8\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-openat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mkdirat-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='chec', 0x4)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
write(0xffffffffffffffff, &(0x7f00000003c0)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, 0x0)
write(0xffffffffffffffff, &(0x7f0000000600)='\n', 0x1)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0), 0x0)
write(0xffffffffffffffff, &(0x7f0000000840), 0x0)

program did not crash
testing program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in usb_ep_enable
extracting C reproducer
testing compiled C program (duration=3m20.846388398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
simplifying C reproducer
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing compiled C program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
program crashed: WARNING in usb_ep_enable
testing program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in usb_ep_enable
validation run: crashed=true
testing program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in usb_ep_enable
validation run: crashed=true
testing program (duration=3m20.846388398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-write-symlinkat-write-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00')
write(0xffffffffffffffff, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r0, &(0x7f00000004c0)='dummy_udc.0\n', 0xc)
write(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in usb_ep_enable
validation run: crashed=true
reproducing took 15h9m23.675385708s
repro crashed as (corrupted=false):
------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480 drivers/usb/gadget/udc/core.c:124, CPU#1: kworker/1:0/27
Modules linked in:
CPU: 1 UID: 0 PID: 27 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_ep_enable+0x1bc/0x480 drivers/usb/gadget/udc/core.c:124
Code: ca 5f 64 fa 49 83 3f 00 48 c7 c0 80 3d f5 8c 49 c7 c0 a0 3d f5 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 25 cf a0 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 10 88 f2 f9 65 8b
RSP: 0018:ffffc90000a38910 EFLAGS: 00010086
RAX: ffffffff8cf53d80 RBX: ffff88802681c0e0 RCX: ffffffff8cf55ba0
RDX: 0000000000000081 RSI: ffffffff8ea0cf25 RDI: ffffffff90ca0550
RBP: dffffc0000000000 R08: ffffffff8cf53da0 R09: 0000000000000002
R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cf55ba0
R13: 0000000000000081 R14: ffffffff90ca0550 R15: ffff88802681c0f8
FS:  0000000000000000(0000) GS:ffff88812472e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2fbc75da08 CR3: 000000007f086000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 hidg_set_alt+0x12a/0xa60 drivers/usb/gadget/function/f_hid.c:1042
 set_config+0x749/0x1160 drivers/usb/gadget/composite.c:1018
 composite_setup+0x1de7/0x3480 drivers/usb/gadget/composite.c:1901
 configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1877
 dummy_timer+0x2f27/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:1955
 __run_hrtimer kernel/time/hrtimer.c:2075 [inline]
 __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2132
 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2149
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 6d 5d a2 f5 f7 c3 00 02 00 00 74 05 e8 f0 f3 ce f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 74 56 93 f5 65 48 8b 05 ac 10 dd 07 48 85 c0 74 18 5b 41 5e c3
RSP: 0018:ffffc90000a1ef50 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
RDX: 0000000000000006 RSI: ffffffff8e773b4b RDI: 0000000000000001
RBP: 0000000000000007 R08: ffffffff90bc18bf R09: 1ffffffff2178317
R10: dffffc0000000000 R11: fffffbfff2178318 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88802681c000 R15: 1ffff11005357694
 spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
 dummy_urb_enqueue+0x587/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1341
 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1543
 usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
 usb_control_msg_send drivers/usb/core/message.c:226 [inline]
 usb_set_configuration+0x12c5/0x2260 drivers/usb/core/message.c:2215
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:623
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	ca 5f 64             	lret   $0x645f
   3:	fa                   	cli
   4:	49 83 3f 00          	cmpq   $0x0,(%r15)
   8:	48 c7 c0 80 3d f5 8c 	mov    $0xffffffff8cf53d80,%rax
   f:	49 c7 c0 a0 3d f5 8c 	mov    $0xffffffff8cf53da0,%r8
  16:	4c 0f 44 c0          	cmove  %rax,%r8
  1a:	4c 89 f7             	mov    %r14,%rdi
  1d:	48 c7 c6 25 cf a0 8e 	mov    $0xffffffff8ea0cf25,%rsi
  24:	44 89 ea             	mov    %r13d,%edx
  27:	4c 89 e1             	mov    %r12,%rcx
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	bd ea ff ff ff       	mov    $0xffffffea,%ebp
  34:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  39:	e8 10 88 f2 f9       	call   0xf9f2884e
  3e:	65                   	gs
  3f:	8b                   	.byte 0x8b

final repro crashed as (corrupted=false):
------------[ cut here ]------------
usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0
WARNING: drivers/usb/gadget/udc/core.c:125 at usb_ep_enable+0x148/0x480 drivers/usb/gadget/udc/core.c:124, CPU#1: kworker/1:0/27
Modules linked in:
CPU: 1 UID: 0 PID: 27 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_ep_enable+0x1bc/0x480 drivers/usb/gadget/udc/core.c:124
Code: ca 5f 64 fa 49 83 3f 00 48 c7 c0 80 3d f5 8c 49 c7 c0 a0 3d f5 8c 4c 0f 44 c0 4c 89 f7 48 c7 c6 25 cf a0 8e 44 89 ea 4c 89 e1 <67> 48 0f b9 3a bd ea ff ff ff 0f 1f 44 00 00 e8 10 88 f2 f9 65 8b
RSP: 0018:ffffc90000a38910 EFLAGS: 00010086
RAX: ffffffff8cf53d80 RBX: ffff88802681c0e0 RCX: ffffffff8cf55ba0
RDX: 0000000000000081 RSI: ffffffff8ea0cf25 RDI: ffffffff90ca0550
RBP: dffffc0000000000 R08: ffffffff8cf53da0 R09: 0000000000000002
R10: 0000000000000003 R11: 8000000000000100 R12: ffffffff8cf55ba0
R13: 0000000000000081 R14: ffffffff90ca0550 R15: ffff88802681c0f8
FS:  0000000000000000(0000) GS:ffff88812472e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2fbc75da08 CR3: 000000007f086000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 hidg_set_alt+0x12a/0xa60 drivers/usb/gadget/function/f_hid.c:1042
 set_config+0x749/0x1160 drivers/usb/gadget/composite.c:1018
 composite_setup+0x1de7/0x3480 drivers/usb/gadget/composite.c:1901
 configfs_composite_setup+0xc7/0x100 drivers/usb/gadget/configfs.c:1877
 dummy_timer+0x2f27/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:1955
 __run_hrtimer kernel/time/hrtimer.c:2075 [inline]
 __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2132
 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2149
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 6d 5d a2 f5 f7 c3 00 02 00 00 74 05 e8 f0 f3 ce f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 74 56 93 f5 65 48 8b 05 ac 10 dd 07 48 85 c0 74 18 5b 41 5e c3
RSP: 0018:ffffc90000a1ef50 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
RDX: 0000000000000006 RSI: ffffffff8e773b4b RDI: 0000000000000001
RBP: 0000000000000007 R08: ffffffff90bc18bf R09: 1ffffffff2178317
R10: dffffc0000000000 R11: fffffbfff2178318 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88802681c000 R15: 1ffff11005357694
 spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
 dummy_urb_enqueue+0x587/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1341
 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1543
 usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
 usb_control_msg_send drivers/usb/core/message.c:226 [inline]
 usb_set_configuration+0x12c5/0x2260 drivers/usb/core/message.c:2215
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:623
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	ca 5f 64             	lret   $0x645f
   3:	fa                   	cli
   4:	49 83 3f 00          	cmpq   $0x0,(%r15)
   8:	48 c7 c0 80 3d f5 8c 	mov    $0xffffffff8cf53d80,%rax
   f:	49 c7 c0 a0 3d f5 8c 	mov    $0xffffffff8cf53da0,%r8
  16:	4c 0f 44 c0          	cmove  %rax,%r8
  1a:	4c 89 f7             	mov    %r14,%rdi
  1d:	48 c7 c6 25 cf a0 8e 	mov    $0xffffffff8ea0cf25,%rsi
  24:	44 89 ea             	mov    %r13d,%edx
  27:	4c 89 e1             	mov    %r12,%rcx
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	bd ea ff ff ff       	mov    $0xffffffea,%ebp
  34:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  39:	e8 10 88 f2 f9       	call   0xf9f2884e
  3e:	65                   	gs
  3f:	8b                   	.byte 0x8b