Extracting prog: 45m4.348691818s Minimizing prog: 1h12m41.071820634s Simplifying prog options: 5m16.37050357s Extracting C: 1m29.763387722s Simplifying C: 9m42.898795297s extracting reproducer from 35 programs testing a last program of every proc single: executing 6 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-mkdirat-openat-write-openat-write-mkdirat-mkdirat-mkdirat-mkdirat-mkdirat-symlinkat-openat-write-mkdirat-mkdirat-symlinkat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$video-ioctl$VIDIOC_S_FMT detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-nanosleep-accept$inet-write-nanosleep detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-accept$inet-recvfrom-sendto$inet-recvfrom detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1144, @local}, 0x10) listen(r0, 0xa) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=tcp,traddr=172.20.20.170,trsvcid=4420,nqn=testnqn,data_digest\x00', 0x47) r2 = accept$inet(r0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000300)=""/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000400)="010080008000000000000002001000"/129, 0x80, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-nanosleep-accept$inet-write-nanosleep detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r1, &(0x7f00000000c0)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000140)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='- - -\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='- - -\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='- - -\x00', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000000c0)='- - -\x00', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0) write(r4, &(0x7f00000000c0)='- - -\x00', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='- - -\x00', 0x5) program did not crash single: failed to extract reproducer bisect: bisecting 35 programs with base timeout 30s testing program (duration=38s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 39, 4, 16, 15, 27, 16, 21, 17, 14, 9, 5, 8, 16, 12, 2, 9, 13, 20, 12, 9, 21, 9, 4, 6, 31, 26, 1, 5, 18, 4, 31, 9, 8, 21] detailed listing: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='2049\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) nanosleep(&(0x7f0000000240)={0x2}, 0x0) mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40402000490000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2e, '\x00'/46}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r1, 0x80845657, &(0x7f0000000500)={0x0, @reserved}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='mem\n\x00', 0x5) executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x505, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf4240, 0x1000}}}}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000400)={0x0, 0x1}, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000500)=@req={0x1000, 0x3, 0x1000, 0x3}, 0x10) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) pipe2(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f0000008000)=""/12, 0xc) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f0000009000)=""/12, 0xc) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f000000a000)=""/12, 0xc) sendmsg(r3, &(0x7f0000000800)={&(0x7f0000000900)=@ll={0x11, 0x300, r1}, 0x14, &(0x7f0000000a00)=[{&(0x7f0000000b00)='\x00', 0x1}], 0x1}, 0x0) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000000314050000000000000000000900020072786530000000000800410072786500070033006c6f0000"], 0x2c}}, 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0x1}, r2}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000600)={0x7, 0x8, 0xfa00, {r2, 0x1}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000800)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000a00)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0x1}, r3}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000900)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback, 0x1}, {0xa, 0x4e20, 0x0, @loopback, 0x1}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000001000)={0x1}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000c00)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000001000)={0x1}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000f00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x7, 0x7, 0x1}, r3}}, 0x120) nanosleep(&(0x7f0000001000)={0x5}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='proc\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000640)='-2 -3 +4\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n\x00', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='nfsd 127.0.0.1 2147483647 my_domain\n\x00', 0x24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='my_domain / 2147483647 9216 0 0 0\n\x00', 0x22) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='my_domain 1 \\x00000000 2147483647 /\n\x00', 0x24) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r5, &(0x7f0000000340)='1\n\x00', 0x2) (async) close(r5) nanosleep(&(0x7f0000000540)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount(&(0x7f00000003c0)=@filename='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400)='nfs4\x00', 0x0, &(0x7f0000000440)='addr=127.0.0.1,clientaddr=127.0.0.1\x00') openat(0xffffffffffffff9c, &(0x7f0000000480)='./mnt/file\x00', 0x42, 0x1ff) setxattr(&(0x7f0000000480)='./mnt/file\x00', &(0x7f00000004c0)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06OWNER@\x00\x00', 0x1c, 0x0) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000600)={0x2, 0x4e24, @empty}, 0x10) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @empty}, {0x2, 0x4e24, 0xac1414bb, @empty}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet(r1, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000600)={0x2, 0x4e24, @empty}, 0x10) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @empty}, {0x2, 0x4e24, 0x7f000001, @empty}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet(r1, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='- - -\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='- - -\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='- - -\x00', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000000c0)='- - -\x00', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0) write(r4, &(0x7f00000000c0)='- - -\x00', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='- - -\x00', 0x5) executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r1, &(0x7f00000000c0)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000140)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/bitmap/max_write_behind\x00', 0x1, 0x0) executing program 5: syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000040)) umount2(&(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2) pwrite64(r0, &(0x7f0000002000)='\x00 \x00\x00', 0x4, 0xc84) mount(&(0x7f0000003000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='f2fs\x00', 0x0, &(0x7f0000004000)='compress_algorithm=zstd:11,compress_log_size=7,compress_extension=*\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000005000)='./file0/test.txt\x00', 0x42, 0x1ff) write(r1, &(0x7f0000006000)='\x00', 0x1000) fsync(r1) executing program 5: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a31000000000800410073697700140033006c6f00"/56], 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000600)={0xa, 0x4e24, 0x0, @empty}, 0x1c) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write(r2, &(0x7f00000001c0)="03000000400000fa0200000000000000000000000000000000000000000000000000000002004e247f00000100000000000000000000000000000000000000000000000000000000e8030000", 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet6(r1, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 5: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000140)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000180)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000001c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000200)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000240)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000280)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000002c0)={0x1000000, 0x0}) executing program 5: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff405e0491021401010203010902200001010080fa0904000002ff5d81000705810300000407050203200004"], 0x0) nanosleep(&(0x7f0000000100)={0x2}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x68, r1, 0x5, 0x0, 0x0, {0x1, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x68}}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x8c, r1, 0x5, 0x0, 0x0, {0x5, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x50}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}]}, 0x8c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '\x00', 0x8, 0x6, 0xff, @local, @remote, [], '\x00P\x00P\x00\x00\x00\x00'}}}}}}}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0/firmware-usb-6.bin\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000400)="5143412d41544831304b0000020000000400000000000800", 0x18) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c3c000000000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) syz_80211_join_ibss(&(0x7f0000000600)='wlan1\x00', &(0x7f0000000700)=@random='syz\x00', 0x4, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./dev\x00', &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./dev/loop0\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='/dev/loop0,65536\x00', 0x11) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000700)="ffffffff0100"/24) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000c00)="00000000010000000000a000000000000300040000000000766f6c3000") nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000e00)=@filename='ubi0_0\x00', &(0x7f0000000d00)='./mnt\x00', &(0x7f0000000f00)='ubifs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/test\x00', 0x42, 0x1ff) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407d1e38310000000000010902220001010080fa09040000010300000009211101000122320007058103400001"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ryos/roccatryos0/info\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/256, 0x100) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, &(0x7f0000000280)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x1, 0x100, '\x00'/256}, 0x0}) executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1144, @local}, 0x10) listen(r0, 0xa) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=tcp,traddr=172.20.20.170,trsvcid=4420,nqn=testnqn,data_digest\x00', 0x47) r2 = accept$inet(r0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000300)=""/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000400)="010080008000000000000002001000"/129, 0x80, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x0, 0x0, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x505, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf4240, 0x1000}}}}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000400)={0x0, 0x1}, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000500)=@req={0x1000, 0x3, 0x1000, 0x3}, 0x10) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) sendmsg(r3, &(0x7f0000000800)={&(0x7f0000000900)=@ll={0x11, 0x300, r1}, 0x14, &(0x7f0000000a00)=[{&(0x7f0000000b00)='\x00', 0x1}], 0x1}, 0x0) executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000300), 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) (async) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./dm_control_12345\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./dm_control_12345\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dm_control_12345\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f64657600") executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x40000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x80000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0xc0000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000f00000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000f00000/0x100000)=nil, 0x100000) executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program did not crash replaying the whole log did not cause a kernel crash single: executing 6 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-mkdirat-openat-write-openat-write-mkdirat-mkdirat-mkdirat-mkdirat-mkdirat-symlinkat-openat-write-mkdirat-mkdirat-symlinkat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_open_dev$video-ioctl$VIDIOC_S_FMT detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-nanosleep-accept$inet-write-nanosleep detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-accept$inet-recvfrom-sendto$inet-recvfrom detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1144, @local}, 0x10) listen(r0, 0xa) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=tcp,traddr=172.20.20.170,trsvcid=4420,nqn=testnqn,data_digest\x00', 0x47) r2 = accept$inet(r0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000300)=""/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000400)="010080008000000000000002001000"/129, 0x80, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-bind$inet-listen-openat$nvme_fabrics-write-nanosleep-accept$inet-write-nanosleep detailed listing: executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r1, &(0x7f00000000c0)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000140)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='- - -\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='- - -\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='- - -\x00', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000000c0)='- - -\x00', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0) write(r4, &(0x7f00000000c0)='- - -\x00', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='- - -\x00', 0x5) program did not crash single: failed to extract reproducer bisect: bisecting 35 programs with base timeout 1m40s testing program (duration=1m48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 39, 4, 16, 15, 27, 16, 21, 17, 14, 9, 5, 8, 16, 12, 2, 9, 13, 20, 12, 9, 21, 9, 4, 6, 31, 26, 1, 5, 18, 4, 31, 9, 8, 21] detailed listing: executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='2049\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) nanosleep(&(0x7f0000000240)={0x2}, 0x0) mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40402000490000010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2e, '\x00'/46}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r1, 0x80845657, &(0x7f0000000500)={0x0, @reserved}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='mem\n\x00', 0x5) executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x505, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf4240, 0x1000}}}}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000400)={0x0, 0x1}, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000500)=@req={0x1000, 0x3, 0x1000, 0x3}, 0x10) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) pipe2(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f0000008000)=""/12, 0xc) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f0000009000)=""/12, 0xc) write(r5, &(0x7f0000000700)="010000000000000010000000", 0xc) read(r4, &(0x7f000000a000)=""/12, 0xc) sendmsg(r3, &(0x7f0000000800)={&(0x7f0000000900)=@ll={0x11, 0x300, r1}, 0x14, &(0x7f0000000a00)=[{&(0x7f0000000b00)='\x00', 0x1}], 0x1}, 0x0) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000000314050000000000000000000900020072786530000000000800410072786500070033006c6f0000"], 0x2c}}, 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0x1}, r2}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000600)={0x7, 0x8, 0xfa00, {r2, 0x1}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000800)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000a00)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0x1}, r3}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000900)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback, 0x1}, {0xa, 0x4e20, 0x0, @loopback, 0x1}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000001000)={0x1}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000c00)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000001000)={0x1}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000f00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x7, 0x7, 0x1}, r3}}, 0x120) nanosleep(&(0x7f0000001000)={0x5}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='proc\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000640)='-2 -3 +4\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n\x00', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='nfsd 127.0.0.1 2147483647 my_domain\n\x00', 0x24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='my_domain / 2147483647 9216 0 0 0\n\x00', 0x22) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='my_domain 1 \\x00000000 2147483647 /\n\x00', 0x24) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r5, &(0x7f0000000340)='1\n\x00', 0x2) (async) close(r5) nanosleep(&(0x7f0000000540)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount(&(0x7f00000003c0)=@filename='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400)='nfs4\x00', 0x0, &(0x7f0000000440)='addr=127.0.0.1,clientaddr=127.0.0.1\x00') openat(0xffffffffffffff9c, &(0x7f0000000480)='./mnt/file\x00', 0x42, 0x1ff) setxattr(&(0x7f0000000480)='./mnt/file\x00', &(0x7f00000004c0)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06OWNER@\x00\x00', 0x1c, 0x0) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000600)={0x2, 0x4e24, @empty}, 0x10) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @empty}, {0x2, 0x4e24, 0xac1414bb, @empty}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet(r1, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000600)={0x2, 0x4e24, @empty}, 0x10) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @empty}, {0x2, 0x4e24, 0x7f000001, @empty}, r3, 0x3e8}}, 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet(r1, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='- - -\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='- - -\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='- - -\x00', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0) write(r3, &(0x7f00000000c0)='- - -\x00', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0) write(r4, &(0x7f00000000c0)='- - -\x00', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='- - -\x00', 0x5) executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r1, &(0x7f00000000c0)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000140)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/bitmap/max_write_behind\x00', 0x1, 0x0) executing program 5: syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000040)) umount2(&(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2) pwrite64(r0, &(0x7f0000002000)='\x00 \x00\x00', 0x4, 0xc84) mount(&(0x7f0000003000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='f2fs\x00', 0x0, &(0x7f0000004000)='compress_algorithm=zstd:11,compress_log_size=7,compress_extension=*\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000005000)='./file0/test.txt\x00', 0x42, 0x1ff) write(r1, &(0x7f0000006000)='\x00', 0x1000) fsync(r1) executing program 5: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a31000000000800410073697700140033006c6f00"/56], 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000600)={0xa, 0x4e24, 0x0, @empty}, 0x1c) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write(r2, &(0x7f00000001c0)="03000000400000fa0200000000000000000000000000000000000000000000000000000002004e247f00000100000000000000000000000000000000000000000000000000000000e8030000", 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet6(r1, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 5: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000140)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000180)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000001c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000200)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000240)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000280)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000002c0)={0x1000000, 0x0}) executing program 5: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff405e0491021401010203010902200001010080fa0904000002ff5d81000705810300000407050203200004"], 0x0) nanosleep(&(0x7f0000000100)={0x2}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x68, r1, 0x5, 0x0, 0x0, {0x1, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x68}}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x8c, r1, 0x5, 0x0, 0x0, {0x5, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x50}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}]}, 0x8c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '\x00', 0x8, 0x6, 0xff, @local, @remote, [], '\x00P\x00P\x00\x00\x00\x00'}}}}}}}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0/firmware-usb-6.bin\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000400)="5143412d41544831304b0000020000000400000000000800", 0x18) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c3c000000000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) syz_80211_join_ibss(&(0x7f0000000600)='wlan1\x00', &(0x7f0000000700)=@random='syz\x00', 0x4, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./dev\x00', &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./dev/loop0\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='/dev/loop0,65536\x00', 0x11) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000700)="ffffffff0100"/24) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000c00)="00000000010000000000a000000000000300040000000000766f6c3000") nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000e00)=@filename='ubi0_0\x00', &(0x7f0000000d00)='./mnt\x00', &(0x7f0000000f00)='ubifs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/test\x00', 0x42, 0x1ff) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407d1e38310000000000010902220001010080fa09040000010300000009211101000122320007058103400001"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ryos/roccatryos0/info\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/256, 0x100) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, &(0x7f0000000280)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x1, 0x100, '\x00'/256}, 0x0}) executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1144, @local}, 0x10) listen(r0, 0xa) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=tcp,traddr=172.20.20.170,trsvcid=4420,nqn=testnqn,data_digest\x00', 0x47) r2 = accept$inet(r0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000300)=""/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000400)="010080008000000000000002001000"/129, 0x80, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x0, 0x0, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x505, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf4240, 0x1000}}}}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000400)={0x0, 0x1}, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000500)=@req={0x1000, 0x3, 0x1000, 0x3}, 0x10) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) sendmsg(r3, &(0x7f0000000800)={&(0x7f0000000900)=@ll={0x11, 0x300, r1}, 0x14, &(0x7f0000000a00)=[{&(0x7f0000000b00)='\x00', 0x1}], 0x1}, 0x0) executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000300), 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) (async) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./dm_control_12345\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./dm_control_12345\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dm_control_12345\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f64657600") executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x40000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x80000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0xc0000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000f00000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000f00000/0x100000)=nil, 0x100000) executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program crashed: WARNING in cx25840_init bisect: bisecting 35 programs bisect: split chunks (needed=false): <35> bisect: split chunk #0 of len 35 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 16, 12, 2, 9, 13, 20, 12, 9, 21, 9, 4, 6, 31, 26, 1, 5, 18, 4, 31, 9, 8, 21] detailed listing: executing program 5: syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000040)) umount2(&(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2) pwrite64(r0, &(0x7f0000002000)='\x00 \x00\x00', 0x4, 0xc84) mount(&(0x7f0000003000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='f2fs\x00', 0x0, &(0x7f0000004000)='compress_algorithm=zstd:11,compress_log_size=7,compress_extension=*\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000005000)='./file0/test.txt\x00', 0x42, 0x1ff) write(r1, &(0x7f0000006000)='\x00', 0x1000) fsync(r1) executing program 5: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a31000000000800410073697700140033006c6f00"/56], 0x38}}, 0x0) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000600)={0xa, 0x4e24, 0x0, @empty}, 0x1c) listen(r1, 0xa) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0x0}, 0x106, 0x2}}, 0x20) write(r2, &(0x7f00000001c0)="03000000400000fa0200000000000000000000000000000000000000000000000000000002004e247f00000100000000000000000000000000000000000000000000000000000000e8030000", 0x48) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) nanosleep(&(0x7f0000000700)={0x0, 0x10000000}, 0x0) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, r3}}, 0x120) r4 = accept4$inet6(r1, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000800)='\x00'/20, 0x14, 0x0, 0x0, 0x0) close(r4) executing program 5: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000140)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000180)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000001c0)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000200)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000240)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000280)={0x1000000, 0x0}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000002c0)={0x1000000, 0x0}) executing program 5: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff405e0491021401010203010902200001010080fa0904000002ff5d81000705810300000407050203200004"], 0x0) nanosleep(&(0x7f0000000100)={0x2}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x68, r1, 0x5, 0x0, 0x0, {0x1, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}]}, 0x68}}, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x8c, r1, 0x5, 0x0, 0x0, {0x5, 0x1}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x50}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x50}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}]}, 0x8c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) syz_emit_ethernet(0x6e, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @local, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '\x00', 0x8, 0x6, 0xff, @local, @remote, [], '\x00P\x00P\x00\x00\x00\x00'}}}}}}}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='ath10k/QCA988X/hw2.0/firmware-usb-6.bin\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000400)="5143412d41544831304b0000020000000400000000000800", 0x18) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c3c000000000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x2, 0xc, "0c0000006801004100000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) syz_80211_join_ibss(&(0x7f0000000600)='wlan1\x00', &(0x7f0000000700)=@random='syz\x00', 0x4, 0x0) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./dev\x00', &(0x7f0000000900)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./dev/loop0\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='/dev/loop0,65536\x00', 0x11) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl(r3, 0x40186f40, &(0x7f0000000700)="ffffffff0100"/24) nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./dev/ubi0\x00', 0x2, 0x0) ioctl(r4, 0x40986f00, &(0x7f0000000c00)="00000000010000000000a000000000000300040000000000766f6c3000") nanosleep(&(0x7f0000001000)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000e00)=@filename='ubi0_0\x00', &(0x7f0000000d00)='./mnt\x00', &(0x7f0000000f00)='ubifs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/test\x00', 0x42, 0x1ff) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407d1e38310000000000010902220001010080fa09040000010300000009211101000122320007058103400001"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ryos/roccatryos0/info\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/256, 0x100) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022320005010902a1010901a100050919012903150025019503750181029501750581030501093009311581257f750895028106c0c0"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x32}}}}, &(0x7f0000000280)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x1, 0x100, '\x00'/256}, 0x0}) executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1144, @local}, 0x10) listen(r0, 0xa) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r1, &(0x7f0000000200)='transport=tcp,traddr=172.20.20.170,trsvcid=4420,nqn=testnqn,data_digest\x00', 0x47) r2 = accept$inet(r0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000300)=""/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000400)="010080008000000000000002001000"/129, 0x80, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x0, 0x0, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x505, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf4240, 0x1000}}}}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000400)={0x0, 0x1}, 0x10) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000500)=@req={0x1000, 0x3, 0x1000, 0x3}, 0x10) mmap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) sendmsg(r3, &(0x7f0000000800)={&(0x7f0000000900)=@ll={0x11, 0x300, r1}, 0x14, &(0x7f0000000a00)=[{&(0x7f0000000b00)='\x00', 0x1}], 0x1}, 0x0) executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000300), 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) (async) open_by_handle_at(r0, &(0x7f0000001000)=@FILEID_INO32_GEN={0x8, 0x1, {0x64}}, 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./dm_control_12345\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./dm_control_12345\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dm_control_12345\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f64657600") executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x40000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x80000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0xc0000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000f00000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000f00000/0x100000)=nil, 0x100000) executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 31, 26, 1, 5, 18, 4, 31, 9, 8, 21] detailed listing: executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./dm_control_12345\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./dm_control_12345\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dm_control_12345\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f64657600") executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x40000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x80000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0xc0000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000f00000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000f00000/0x100000)=nil, 0x100000) executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <11> bisect: split chunk #0 of len 11 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 31, 9, 8, 21] detailed listing: executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./dm_control_12345\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./dm_control_12345\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dm_control_12345\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f64657600") executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x40000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0x80000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x11, r0, 0xc0000000) madvise(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x16) munmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000) mmap(&(0x7f0000f00000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000f00000/0x100000)=nil, 0x100000) executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write(r1, &(0x7f0000000100)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369,data_digest\x00', 0x41) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000180)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001010203010902300001010080320904000002ff00000007058102000200070501020002000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000200)='\x00'/64) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000500)={0x1, @raw_data}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) symlinkat(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 31, 26, 1, 5, 18] detailed listing: executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5, 18] detailed listing: executing program 1: nanosleep(&(0x7f0000001d00)={0x0, 0xf4240}, 0x0) executing program 1: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000080)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f00000000c0)={0x30000000, 0x0, 0x80000}) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000100)={0x30000000, 0x0, 0x80000}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x1, &(0x7f0000000100), &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000500)=@IORING_OP_WRITEV={0x16, 0x10, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006c736e616d6500"/112, 0x78}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1\x00', 0x2) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/dlm/lsname/event_done\x00', 0x1, 0x0) write(r7, &(0x7f0000000a00)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/kernel/dlm/lsname/control\x00', 0x1, 0x0) write(r8, &(0x7f0000000c00)='1\x00', 0x2) nanosleep(&(0x7f0000000d00)={0x1}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 31, 26] detailed listing: executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0\n', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='raid1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1:1\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='0\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r6, &(0x7f0000000440)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r7, &(0x7f00000004c0)='writemostly\n', 0xc) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r8, &(0x7f0000000540)='active\n', 0x7) r9 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r9, &(0x7f00000005c0)='idle\n', 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x1, 0x0) write(r10, &(0x7f0000000640)='1\n', 0x2) r11 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0) write(r11, &(0x7f00000006c0)='1024\n', 0x5) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 31] detailed listing: executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000100)={0x0, 0x10000000}, 0x0) read(r0, &(0x7f0000000140)=""/1, 0x1) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="02fa", 0x2}, {&(0x7f0000000200)="0200", 0x2}], 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep-mkdirat-mount-openat-ioctl$VIDIOC_TRY_FMT detailed listing: executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) program crashed: WARNING in cx25840_init bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep-mkdirat-mount-openat-ioctl$VIDIOC_TRY_FMT detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0d05640, &(0x7f0000000400)={0x1, @pix={0x100, 0x100, 0x56595559, 0x1, 0x200, 0x20000, 0x1}}) program crashed: WARNING in cx25840_init bisect: concatenation succeeded found reproducer with 31 syscalls minimizing guilty program testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep-mkdirat-mount-openat detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/video16\x00', 0x0, 0x0) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep-mkdirat-mount detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep-mkdirat detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-nanosleep detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) nanosleep(&(0x7f0000000300)={0x1}, 0x0) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\b') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)='\b\x00') program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000200)="0884") program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)='\x00') syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="01") syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in corrupted a never seen crash title: WARNING in corrupted, ignore simplifying guilty program options testing program (duration=1m37.46484666s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program did not crash testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init extracting C reproducer testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init simplifying C reproducer testing compiled C program (duration=1m37.46484666s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program did not crash testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init testing compiled C program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read program crashed: WARNING in cx25840_init testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init validation run: crashed=true testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init validation run: crashed=true testing program (duration=1m37.46484666s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x75, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902630001010080320904000003ff0000000705010200020007058102000200070582020002000904000103ff0000000705010200020007058102000200070582010002010904000603ff000000070501020002000705810200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) program crashed: WARNING in cx25840_init validation run: crashed=true reproducing took 2h18m27.803600982s repro crashed as (corrupted=false): dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (9/0) ------------[ cut here ]------------ 1 WARNING: drivers/media/i2c/cx25840/cx25840-core.c:2313 at cx25840_init+0xa3/0x110 drivers/media/i2c/cx25840/cx25840-core.c:2313, CPU#1: kworker/1:3/5345 Modules linked in: CPU: 1 UID: 0 PID: 5345 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:cx25840_init+0xa3/0x110 drivers/media/i2c/cx25840/cx25840-core.c:2313 Code: e4 02 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 5e 41 c7 06 2a b5 2a 01 89 de e8 c5 66 00 00 eb 09 e8 fe db c2 f9 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 d6 61 0b f9 cc 89 f9 80 RSP: 0018:ffffc9000329ebd0 EFLAGS: 00010293 RAX: ffffffff8804df22 RBX: 00000000000ac8aa RCX: ffff888036b38000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000000 R08: ffff88802ca771bb R09: 1ffff1100594ee37 R10: dffffc0000000000 R11: ffffffff8804de80 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88802d2b0040 R15: ffff88802d2b0338 FS: 0000000000000000(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5993d97a16 CR3: 00000000711ee000 CR4: 0000000000350ef0 Call Trace: cxusb_medion_register_analog_subdevs drivers/media/usb/dvb-usb/cxusb-analog.c:1730 [inline] cxusb_medion_register_analog+0x307/0x1130 drivers/media/usb/dvb-usb/cxusb-analog.c:1793 cxusb_probe+0x664/0x710 drivers/media/usb/dvb-usb/cxusb.c:1615 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (6/0) dvb-usb: bulk message failed: -71 (9/0) dvb-usb: bulk message failed: -71 (9/0) ------------[ cut here ]------------ 1 WARNING: drivers/media/i2c/cx25840/cx25840-core.c:2313 at cx25840_init+0xa3/0x110 drivers/media/i2c/cx25840/cx25840-core.c:2313, CPU#1: kworker/1:3/5345 Modules linked in: CPU: 1 UID: 0 PID: 5345 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:cx25840_init+0xa3/0x110 drivers/media/i2c/cx25840/cx25840-core.c:2313 Code: e4 02 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 5e 41 c7 06 2a b5 2a 01 89 de e8 c5 66 00 00 eb 09 e8 fe db c2 f9 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 d6 61 0b f9 cc 89 f9 80 RSP: 0018:ffffc9000329ebd0 EFLAGS: 00010293 RAX: ffffffff8804df22 RBX: 00000000000ac8aa RCX: ffff888036b38000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000000 R08: ffff88802ca771bb R09: 1ffff1100594ee37 R10: dffffc0000000000 R11: ffffffff8804de80 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88802d2b0040 R15: ffff88802d2b0338 FS: 0000000000000000(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5993d97a16 CR3: 00000000711ee000 CR4: 0000000000350ef0 Call Trace: cxusb_medion_register_analog_subdevs drivers/media/usb/dvb-usb/cxusb-analog.c:1730 [inline] cxusb_medion_register_analog+0x307/0x1130 drivers/media/usb/dvb-usb/cxusb-analog.c:1793 cxusb_probe+0x664/0x710 drivers/media/usb/dvb-usb/cxusb.c:1615 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245