Extracting prog: 2h58m43.734356764s
Minimizing prog: 33m50.334732257s
Simplifying prog options: 0s
Extracting C: 2m25.22149744s
Simplifying C: 9m10.958948344s


extracting reproducer from 21 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_route-socket$inet-sendmsg$nl_route_sched-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-openat$audio-ioctl$SOUND_MIXER_READ_VOLUME-connect$unix-sendmmsg$unix-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_TSINFO_GET-sched_setaffinity-recvmmsg-fsopen-fsconfig$FSCONFIG_SET_STRING-gettid-sendmmsg$unix-fsconfig$FSCONFIG_CMD_CREATE-syz_emit_vhci-tkill
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-socket$alg-clock_adjtime-io_setup-syz_init_net_socket$x25-socket$nl_route-openat$sequencer-write$P9_RSTATu-syz_open_dev$vbi-ioctl$SIOCX25SENDCALLACCPT-ioctl$TUNSETIFF
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): open-timer_create-fcntl$lock-mprotect-timer_settime-mmap-setpriority-futex-fremovexattr-syz_init_net_socket$bt_hci-bind$bt_hci-recvmmsg-socket$inet6-close-socket$l2tp6-socket$inet6_tcp-setsockopt$inet6_IPV6_FLOWLABEL_MGR-bind$alg-setsockopt$ALG_SET_KEY-syz_open_dev$ttys-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP
detailed listing:
executing program 0:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-openat$ttyS3-mkdirat-mount$fuse-mount-chdir-open-mkdirat-mkdirat-socketpair$unix-ioctl$AUTOFS_IOC_PROTOSUBVER
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket$unix-ioctl$sock_SIOCGIFINDEX-openat$tun-bpf$TOKEN_CREATE-close-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-sendmsg$nl_route_sched-openat$udambuf-memfd_create-ftruncate-syz_genetlink_get_family_id$batadv-ioctl$UDMABUF_CREATE-syz_usb_connect-ioctl$DMA_BUF_IOCTL_SYNC
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000580)=0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket$unix-ioctl$sock_SIOCGIFINDEX-openat$tun-bpf$TOKEN_CREATE-close-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-sendmsg$nl_route_sched-openat$udambuf-memfd_create-ftruncate-syz_genetlink_get_family_id$batadv-fcntl$addseals-ioctl$UDMABUF_CREATE-syz_usb_connect-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
fcntl$addseals(r7, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r8, 0xffffffffffffffff, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 21 programs with base timeout 1m40s
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 12, 29, 23, 2, 4, 23, 8, 21, 10, 23, 24, 29, 4, 4, 11, 21, 11, 23, 5, 27]
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r2 = socket(0xa, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000)
mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
r3 = userfaultfd(0x801)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil)
sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@expire={0x104, 0x18, 0x1, 0x70bd26, 0x25dfdbfe, {{{@in6=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e21, 0x9, 0x4e20, 0x0, 0xa, 0x60, 0x80, 0x3c}, {@in=@loopback, 0x4d4, 0x33}, @in=@broadcast, {0xd80c, 0x7f, 0x1, 0xa3d6, 0x9, 0x7f, 0x1, 0x2}, {0xc, 0x401, 0x702, 0xffffffffffffff03}, {0x9a55, 0x6, 0x9}, 0x70bd29, 0x34ff, 0x2, 0x0, 0x3, 0x10}}, [@mark={0xc, 0x15, {0x35075a, 0x1}}]}, 0x104}, 0x1, 0x0, 0x0, 0x84}, 0x4c010)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3})
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="1800120076000d0b"], 0x18}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000888}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getchain={0x3c, 0x66, 0x2, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xe, 0x4}, {0x2, 0x6}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x40}, {0x8, 0xb, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008084)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/i8042/unbind\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='i8042\x00', 0x6)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xb4, 0x2, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x4}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x491}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0xdd}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x16}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x10000}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x15)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x138, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104}]}}]}, 0x138}}, 0x0)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 1:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, 0x0, &(0x7f0000000140))
socket$inet6(0xa, 0x80002, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$igmp6(0xa, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
request_key(0x0, 0x0, 0x0, 0x0)
r4 = socket$inet6(0xa, 0x802, 0x0)
setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb)
connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31)
socket$inet6_sctp(0xa, 0x801, 0x84)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000280)=[{0x28, 0x6, 0x40, 0xbfffdffe}, {0x80000006, 0x9, 0x1d, 0x7fff}]}, 0x8)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000)
sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800)
executing program 6:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, 0x0, &(0x7f0000000140))
socket$inet6(0xa, 0x80002, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$igmp6(0xa, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
request_key(0x0, 0x0, 0x0, 0x0)
r4 = socket$inet6(0xa, 0x802, 0x0)
setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb)
connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800)
executing program 5:
syz_emit_ethernet(0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3286dd6018232500202c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080202"], 0x0)
syz_emit_ethernet(0xa6, &(0x7f0000000540)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000086dd6018232500702c00fe8000000000000000000000000000bbfe80000000"], 0x0)
executing program 5:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
ftruncate(0xffffffffffffffff, 0x1000006)
fcntl$addseals(0xffffffffffffffff, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1000000})
executing program 5:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
fcntl$addseals(r7, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r8, 0xffffffffffffffff, 0x0)
executing program 3:
symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f00000004c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140))
chdir(&(0x7f0000000000)='./bus\x00')
rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='.\x02\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000000)=""/238, 0xee)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000580)=0x1)
executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, 0x0, 0x0)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4)
write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0001}]})
executing program 4:
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$sndctrl(0x0, 0x0, 0x0)
getpid()
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6)
shutdown(r1, 0x32ce970513f32900)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r2, &(0x7f00000000c0)='1\x00', 0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/vmstat\x00', 0x0, 0x0)
preadv(r3, &(0x7f00000000c0), 0x0, 0xf0, 0xa)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a45320, &(0x7f00000003c0)={{0x8}, 'port0\x00', 0xe1, 0x70031, 0x7fffffff, 0x9, 0x97b874a3, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x5})
socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740))
write(0xffffffffffffffff, &(0x7f00000001c0)='1', 0x1)
syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x9840)
executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000100)={0x8, &(0x7f00000001c0)=[{0x2b, '\x00', @buffer={"99b6904f51526152b4478e5cd83c4bd355b43885f2dea65fde7a96c41c7c34df", 0x20}, 0x7fff}]})
accept4$packet(r0, 0x0, &(0x7f00000000c0), 0x80800)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
write$dsp(0xffffffffffffffff, &(0x7f0000000100), 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2)
socket$tipc(0x1e, 0x2, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})
r3 = syz_open_procfs(0x0, &(0x7f0000000480)='coredump_filter\x00')
read$FUSE(r3, 0x0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r5, <r6=>0xffffffffffffffff}, 0x4)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r7}, 0xc)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r7, r6}, 0xc)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0)
r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0)
r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0)
r2 = openat$ppp(0xffffff9c, &(0x7f00000003c0), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000640)=0x2)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x7, 0x6, 0x4, 0xee, 0x4, 0x7ffd]})
r3 = inotify_init()
inotify_add_watch(r3, &(0x7f0000000340)='.\x00', 0xa50003d1)
readv(r3, &(0x7f0000000140)=[{&(0x7f0000000280)=""/181, 0xb5}], 0x1)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
unshare(0x6a040000)
r4 = socket(0x2, 0x80805, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000240)={0x84, @broadcast, 0x4e20, 0x3, 'fo\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@loopback, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff)
close(0x3)
open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000dc0)=@filter={'filter\x00', 0x42, 0x4, 0x358, 0xffffffff, 0x1a4, 0xec, 0xec, 0xffffffff, 0xffffffff, 0x2c4, 0x2c4, 0x2c4, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @local, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xc8, 0xec, 0x0, {0x100000000000000}, [@common=@inet=@udp={{0x2c}, {[0x4e21, 0x4e20], [0x4e23, 0x4e23]}}, @common=@unspec=@connmark={{0x2c}, {0x5}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00', 0x1, {0x1ff, 0x100}}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@common=@unspec=@state={{0x24}, {0x7}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x5b, 0x1}, 0x0, 0xb4, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x24}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@NFLOG={0x6c, 'NFLOG\x00', 0x0, {0x4, 0xfffe, 0x8000, 0x11, 0x0, "1c70c140687fea1ca1272e16b93a2e21cd0f0ab7f51302f21ceb2f6f1888546b03a09213bd3c9a20228e44a4e6356ec7ca03a902572b5981171a7c74ba88f495"}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3b4)
write$cgroup_subtree(r1, &(0x7f00000005c0)={[{0x2b, 'perf_event'}, {0x2d, 'net_cls'}, {0x2b, 'pids'}, {0x2d, 'rdma'}, {0x38, 'hugetlb'}, {0x2b, 'memory'}, {0x6, 'devices'}, {0x2d, 'rlimit'}, {0x2b, 'perf_event'}, {0x2d, 'devices'}]}, 0x58)
socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = socket(0x10, 0x3, 0x0)
write(r6, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24)
write$sysctl(0xffffffffffffffff, &(0x7f0000000100)='4\x00', 0x2)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x14, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
r7 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r7, &(0x7f0000000000)={0x2, 0x4820, @broadcast}, 0x10)
connect$inet(r7, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x23)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\x0e\x99Z$Y\xbd!A\xaa\xa8\x8dn\x969\\/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c<M\n\xc0`[\x82\xf6$\xa4\xbe\x1e\xd3\xe4\xd9L\x14\xed\xcfK\xcc\xeb,\x1a1\xa6\xf3e\xc2F\xc3\x00\xaa\xd5\xfc\x1bR\xa9\x8c\xb4&\x9f\xa2$\x06\x1a\xb0W#\xf4\xde6\x04c\xc0\xeec\xa0l\xd5d\xe5\xcd\xb2\xc10\x97w\x87\xe5\x06\x91W\rr\xf5\x97-\xe8pO\xeb]\xc2\x98C\xffK\xa0\xb3\\\x99{\xcdR\x92\x94\xf7\x1d\x01Q\x1a\xbd\x15b\x15\xd2)[p`\xb3\x03\xa7p\'X\xec\xcdoX\x05\xff\xff/\xd15)\xeatn\xa3\x88\x13i\xb6\x7ft\x95\xd7\x01o\xb2\xad\xb8\x89i@\f\xffS&\x8a\xc9\xfez\xc2\x90\xe7F\xa6\xdb\r\x03j,N\xe1lw\n\xad\xe8\xf0\xbd\xa1\x98\xce\xf9\x1eR\x9cc\xc5ke_\xa7\x11\"\x04\xd8.\xa0\x15\x83\xf1\x94\x00\x00\x00\x00\x00\x00\x00g\xc6\fc\xa26\xd8\xdf\xef\xf7\x9c\x1a\xef\x8am\x8b7\xcf\xc5\xa6\xf4\f\xabj%Y\xa9\xdd\x0e9e\xba\xec\x99@\xd2', 0x0)
executing program 6:
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r0, <r1=>0xffffffffffffffff}, 0x4)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc)
executing program 4:
syz_io_uring_setup(0x3b, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$mtd(0x0, 0x0, 0x101c02)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5)
ioctl$MEMREADOOB(r0, 0xc0104d04, &(0x7f0000000080)={0x7fffffff, 0x0, 0x0})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 7 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_route-socket$inet-sendmsg$nl_route_sched-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-openat$audio-ioctl$SOUND_MIXER_READ_VOLUME-connect$unix-sendmmsg$unix-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_TSINFO_GET-sched_setaffinity-recvmmsg-fsopen-fsconfig$FSCONFIG_SET_STRING-gettid-sendmmsg$unix-fsconfig$FSCONFIG_CMD_CREATE-syz_emit_vhci-tkill
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-socket$alg-clock_adjtime-io_setup-syz_init_net_socket$x25-socket$nl_route-openat$sequencer-write$P9_RSTATu-syz_open_dev$vbi-ioctl$SIOCX25SENDCALLACCPT-ioctl$TUNSETIFF
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): open-timer_create-fcntl$lock-mprotect-timer_settime-mmap-setpriority-futex-fremovexattr-syz_init_net_socket$bt_hci-bind$bt_hci-recvmmsg-socket$inet6-close-socket$l2tp6-socket$inet6_tcp-setsockopt$inet6_IPV6_FLOWLABEL_MGR-bind$alg-setsockopt$ALG_SET_KEY-syz_open_dev$ttys-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP
detailed listing:
executing program 0:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-openat$ttyS3-mkdirat-mount$fuse-mount-chdir-open-mkdirat-mkdirat-socketpair$unix-ioctl$AUTOFS_IOC_PROTOSUBVER
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket$unix-ioctl$sock_SIOCGIFINDEX-openat$tun-bpf$TOKEN_CREATE-close-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-sendmsg$nl_route_sched-openat$udambuf-memfd_create-ftruncate-syz_genetlink_get_family_id$batadv-ioctl$UDMABUF_CREATE-syz_usb_connect-ioctl$DMA_BUF_IOCTL_SYNC
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000580)=0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-socket$unix-ioctl$sock_SIOCGIFINDEX-openat$tun-bpf$TOKEN_CREATE-close-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-sendmsg$nl_route_sched-openat$udambuf-memfd_create-ftruncate-syz_genetlink_get_family_id$batadv-fcntl$addseals-ioctl$UDMABUF_CREATE-syz_usb_connect-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
fcntl$addseals(r7, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r8, 0xffffffffffffffff, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 21 programs with base timeout 6m0s
testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 12, 29, 23, 2, 4, 23, 8, 21, 10, 23, 24, 29, 4, 4, 11, 21, 11, 23, 5, 27]
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r2 = socket(0xa, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000)
mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
r3 = userfaultfd(0x801)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil)
sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@expire={0x104, 0x18, 0x1, 0x70bd26, 0x25dfdbfe, {{{@in6=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e21, 0x9, 0x4e20, 0x0, 0xa, 0x60, 0x80, 0x3c}, {@in=@loopback, 0x4d4, 0x33}, @in=@broadcast, {0xd80c, 0x7f, 0x1, 0xa3d6, 0x9, 0x7f, 0x1, 0x2}, {0xc, 0x401, 0x702, 0xffffffffffffff03}, {0x9a55, 0x6, 0x9}, 0x70bd29, 0x34ff, 0x2, 0x0, 0x3, 0x10}}, [@mark={0xc, 0x15, {0x35075a, 0x1}}]}, 0x104}, 0x1, 0x0, 0x0, 0x84}, 0x4c010)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3})
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="1800120076000d0b"], 0x18}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000888}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getchain={0x3c, 0x66, 0x2, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xe, 0x4}, {0x2, 0x6}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x40}, {0x8, 0xb, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008084)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/i8042/unbind\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='i8042\x00', 0x6)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xb4, 0x2, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x4}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x491}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0xdd}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x16}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x10000}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x15)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x138, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104}]}}]}, 0x138}}, 0x0)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 1:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, 0x0, &(0x7f0000000140))
socket$inet6(0xa, 0x80002, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$igmp6(0xa, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
request_key(0x0, 0x0, 0x0, 0x0)
r4 = socket$inet6(0xa, 0x802, 0x0)
setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb)
connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31)
socket$inet6_sctp(0xa, 0x801, 0x84)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000280)=[{0x28, 0x6, 0x40, 0xbfffdffe}, {0x80000006, 0x9, 0x1d, 0x7fff}]}, 0x8)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000)
sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800)
executing program 6:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, 0x0, &(0x7f0000000140))
socket$inet6(0xa, 0x80002, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$igmp6(0xa, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
request_key(0x0, 0x0, 0x0, 0x0)
r4 = socket$inet6(0xa, 0x802, 0x0)
setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb)
connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800)
executing program 5:
syz_emit_ethernet(0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3286dd6018232500202c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa080202"], 0x0)
syz_emit_ethernet(0xa6, &(0x7f0000000540)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000086dd6018232500702c00fe8000000000000000000000000000bbfe80000000"], 0x0)
executing program 5:
r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
ftruncate(0xffffffffffffffff, 0x1000006)
fcntl$addseals(0xffffffffffffffff, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1000000})
executing program 5:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
fcntl$addseals(r7, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]})
close_range(r8, 0xffffffffffffffff, 0x0)
executing program 3:
symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f00000004c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140))
chdir(&(0x7f0000000000)='./bus\x00')
rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='.\x02\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000000)=""/238, 0xee)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000580)=0x1)
executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, 0x0, 0x0)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4)
write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0001}]})
executing program 4:
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$sndctrl(0x0, 0x0, 0x0)
getpid()
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6)
shutdown(r1, 0x32ce970513f32900)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r2, &(0x7f00000000c0)='1\x00', 0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/vmstat\x00', 0x0, 0x0)
preadv(r3, &(0x7f00000000c0), 0x0, 0xf0, 0xa)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a45320, &(0x7f00000003c0)={{0x8}, 'port0\x00', 0xe1, 0x70031, 0x7fffffff, 0x9, 0x97b874a3, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x5})
socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740))
write(0xffffffffffffffff, &(0x7f00000001c0)='1', 0x1)
syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x9840)
executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000100)={0x8, &(0x7f00000001c0)=[{0x2b, '\x00', @buffer={"99b6904f51526152b4478e5cd83c4bd355b43885f2dea65fde7a96c41c7c34df", 0x20}, 0x7fff}]})
accept4$packet(r0, 0x0, &(0x7f00000000c0), 0x80800)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
write$dsp(0xffffffffffffffff, &(0x7f0000000100), 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2)
socket$tipc(0x1e, 0x2, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})
r3 = syz_open_procfs(0x0, &(0x7f0000000480)='coredump_filter\x00')
read$FUSE(r3, 0x0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r5, <r6=>0xffffffffffffffff}, 0x4)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r7}, 0xc)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r7, r6}, 0xc)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0)
r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0)
r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0)
r2 = openat$ppp(0xffffff9c, &(0x7f00000003c0), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000640)=0x2)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x7, 0x6, 0x4, 0xee, 0x4, 0x7ffd]})
r3 = inotify_init()
inotify_add_watch(r3, &(0x7f0000000340)='.\x00', 0xa50003d1)
readv(r3, &(0x7f0000000140)=[{&(0x7f0000000280)=""/181, 0xb5}], 0x1)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
unshare(0x6a040000)
r4 = socket(0x2, 0x80805, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000240)={0x84, @broadcast, 0x4e20, 0x3, 'fo\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@loopback, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff)
close(0x3)
open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000dc0)=@filter={'filter\x00', 0x42, 0x4, 0x358, 0xffffffff, 0x1a4, 0xec, 0xec, 0xffffffff, 0xffffffff, 0x2c4, 0x2c4, 0x2c4, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @local, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xc8, 0xec, 0x0, {0x100000000000000}, [@common=@inet=@udp={{0x2c}, {[0x4e21, 0x4e20], [0x4e23, 0x4e23]}}, @common=@unspec=@connmark={{0x2c}, {0x5}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00', 0x1, {0x1ff, 0x100}}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@common=@unspec=@state={{0x24}, {0x7}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x5b, 0x1}, 0x0, 0xb4, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x24}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@NFLOG={0x6c, 'NFLOG\x00', 0x0, {0x4, 0xfffe, 0x8000, 0x11, 0x0, "1c70c140687fea1ca1272e16b93a2e21cd0f0ab7f51302f21ceb2f6f1888546b03a09213bd3c9a20228e44a4e6356ec7ca03a902572b5981171a7c74ba88f495"}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3b4)
write$cgroup_subtree(r1, &(0x7f00000005c0)={[{0x2b, 'perf_event'}, {0x2d, 'net_cls'}, {0x2b, 'pids'}, {0x2d, 'rdma'}, {0x38, 'hugetlb'}, {0x2b, 'memory'}, {0x6, 'devices'}, {0x2d, 'rlimit'}, {0x2b, 'perf_event'}, {0x2d, 'devices'}]}, 0x58)
socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = socket(0x10, 0x3, 0x0)
write(r6, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24)
write$sysctl(0xffffffffffffffff, &(0x7f0000000100)='4\x00', 0x2)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x14, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
r7 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r7, &(0x7f0000000000)={0x2, 0x4820, @broadcast}, 0x10)
connect$inet(r7, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x23)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\x0e\x99Z$Y\xbd!A\xaa\xa8\x8dn\x969\\/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c<M\n\xc0`[\x82\xf6$\xa4\xbe\x1e\xd3\xe4\xd9L\x14\xed\xcfK\xcc\xeb,\x1a1\xa6\xf3e\xc2F\xc3\x00\xaa\xd5\xfc\x1bR\xa9\x8c\xb4&\x9f\xa2$\x06\x1a\xb0W#\xf4\xde6\x04c\xc0\xeec\xa0l\xd5d\xe5\xcd\xb2\xc10\x97w\x87\xe5\x06\x91W\rr\xf5\x97-\xe8pO\xeb]\xc2\x98C\xffK\xa0\xb3\\\x99{\xcdR\x92\x94\xf7\x1d\x01Q\x1a\xbd\x15b\x15\xd2)[p`\xb3\x03\xa7p\'X\xec\xcdoX\x05\xff\xff/\xd15)\xeatn\xa3\x88\x13i\xb6\x7ft\x95\xd7\x01o\xb2\xad\xb8\x89i@\f\xffS&\x8a\xc9\xfez\xc2\x90\xe7F\xa6\xdb\r\x03j,N\xe1lw\n\xad\xe8\xf0\xbd\xa1\x98\xce\xf9\x1eR\x9cc\xc5ke_\xa7\x11\"\x04\xd8.\xa0\x15\x83\xf1\x94\x00\x00\x00\x00\x00\x00\x00g\xc6\fc\xa26\xd8\xdf\xef\xf7\x9c\x1a\xef\x8am\x8b7\xcf\xc5\xa6\xf4\f\xabj%Y\xa9\xdd\x0e9e\xba\xec\x99@\xd2', 0x0)
executing program 6:
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r0, <r1=>0xffffffffffffffff}, 0x4)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc)
executing program 4:
syz_io_uring_setup(0x3b, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$mtd(0x0, 0x0, 0x101c02)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5)
ioctl$MEMREADOOB(r0, 0xc0104d04, &(0x7f0000000080)={0x7fffffff, 0x0, 0x0})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program crashed: memory leak in gadget_bind
bisect: bisecting 21 programs
bisect: split chunks (needed=false): <21>
bisect: split chunk #0 of len 21 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 21, 10, 23, 24, 29, 4, 4, 11, 21, 11, 23, 5, 27]
detailed listing:
executing program 3:
symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f00000004c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140))
chdir(&(0x7f0000000000)='./bus\x00')
rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='.\x02\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000000)=""/238, 0xee)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8)
close(r3)
r4 = socket(0x10, 0x4, 0xffff8001)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'macvlan0\x00', @multicast})
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8080)
r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r7 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2)
ftruncate(r7, 0x1000006)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r4)
r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x1000000})
syz_usb_connect(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd5000000010902"], 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, &(0x7f0000000580)=0x1)
executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, 0x0, 0x0)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4)
write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0001}]})
executing program 4:
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$sndctrl(0x0, 0x0, 0x0)
getpid()
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6)
shutdown(r1, 0x32ce970513f32900)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r2, &(0x7f00000000c0)='1\x00', 0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/vmstat\x00', 0x0, 0x0)
preadv(r3, &(0x7f00000000c0), 0x0, 0xf0, 0xa)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a45320, &(0x7f00000003c0)={{0x8}, 'port0\x00', 0xe1, 0x70031, 0x7fffffff, 0x9, 0x97b874a3, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x5})
socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740))
write(0xffffffffffffffff, &(0x7f00000001c0)='1', 0x1)
syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x9840)
executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000100)={0x8, &(0x7f00000001c0)=[{0x2b, '\x00', @buffer={"99b6904f51526152b4478e5cd83c4bd355b43885f2dea65fde7a96c41c7c34df", 0x20}, 0x7fff}]})
accept4$packet(r0, 0x0, &(0x7f00000000c0), 0x80800)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
write$dsp(0xffffffffffffffff, &(0x7f0000000100), 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2)
socket$tipc(0x1e, 0x2, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})
r3 = syz_open_procfs(0x0, &(0x7f0000000480)='coredump_filter\x00')
read$FUSE(r3, 0x0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r5, <r6=>0xffffffffffffffff}, 0x4)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r7}, 0xc)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r7, r6}, 0xc)
close_range(r2, 0xffffffffffffffff, 0x0)
executing program 2:
openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0)
r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0)
r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0)
r2 = openat$ppp(0xffffff9c, &(0x7f00000003c0), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000640)=0x2)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x7, 0x6, 0x4, 0xee, 0x4, 0x7ffd]})
r3 = inotify_init()
inotify_add_watch(r3, &(0x7f0000000340)='.\x00', 0xa50003d1)
readv(r3, &(0x7f0000000140)=[{&(0x7f0000000280)=""/181, 0xb5}], 0x1)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
unshare(0x6a040000)
r4 = socket(0x2, 0x80805, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000240)={0x84, @broadcast, 0x4e20, 0x3, 'fo\x00', 0x2, 0x660f537e, 0x3}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000440)={{0x84, @multicast2, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@loopback, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44)
syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff)
close(0x3)
open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000dc0)=@filter={'filter\x00', 0x42, 0x4, 0x358, 0xffffffff, 0x1a4, 0xec, 0xec, 0xffffffff, 0xffffffff, 0x2c4, 0x2c4, 0x2c4, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @local, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xc8, 0xec, 0x0, {0x100000000000000}, [@common=@inet=@udp={{0x2c}, {[0x4e21, 0x4e20], [0x4e23, 0x4e23]}}, @common=@unspec=@connmark={{0x2c}, {0x5}}]}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00', 0x1, {0x1ff, 0x100}}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@common=@unspec=@state={{0x24}, {0x7}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x5b, 0x1}, 0x0, 0xb4, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x24}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@NFLOG={0x6c, 'NFLOG\x00', 0x0, {0x4, 0xfffe, 0x8000, 0x11, 0x0, "1c70c140687fea1ca1272e16b93a2e21cd0f0ab7f51302f21ceb2f6f1888546b03a09213bd3c9a20228e44a4e6356ec7ca03a902572b5981171a7c74ba88f495"}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3b4)
write$cgroup_subtree(r1, &(0x7f00000005c0)={[{0x2b, 'perf_event'}, {0x2d, 'net_cls'}, {0x2b, 'pids'}, {0x2d, 'rdma'}, {0x38, 'hugetlb'}, {0x2b, 'memory'}, {0x6, 'devices'}, {0x2d, 'rlimit'}, {0x2b, 'perf_event'}, {0x2d, 'devices'}]}, 0x58)
socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = socket(0x10, 0x3, 0x0)
write(r6, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24)
write$sysctl(0xffffffffffffffff, &(0x7f0000000100)='4\x00', 0x2)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x14, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
r7 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r7, &(0x7f0000000000)={0x2, 0x4820, @broadcast}, 0x10)
connect$inet(r7, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x23)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\x0e\x99Z$Y\xbd!A\xaa\xa8\x8dn\x969\\/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c<M\n\xc0`[\x82\xf6$\xa4\xbe\x1e\xd3\xe4\xd9L\x14\xed\xcfK\xcc\xeb,\x1a1\xa6\xf3e\xc2F\xc3\x00\xaa\xd5\xfc\x1bR\xa9\x8c\xb4&\x9f\xa2$\x06\x1a\xb0W#\xf4\xde6\x04c\xc0\xeec\xa0l\xd5d\xe5\xcd\xb2\xc10\x97w\x87\xe5\x06\x91W\rr\xf5\x97-\xe8pO\xeb]\xc2\x98C\xffK\xa0\xb3\\\x99{\xcdR\x92\x94\xf7\x1d\x01Q\x1a\xbd\x15b\x15\xd2)[p`\xb3\x03\xa7p\'X\xec\xcdoX\x05\xff\xff/\xd15)\xeatn\xa3\x88\x13i\xb6\x7ft\x95\xd7\x01o\xb2\xad\xb8\x89i@\f\xffS&\x8a\xc9\xfez\xc2\x90\xe7F\xa6\xdb\r\x03j,N\xe1lw\n\xad\xe8\xf0\xbd\xa1\x98\xce\xf9\x1eR\x9cc\xc5ke_\xa7\x11\"\x04\xd8.\xa0\x15\x83\xf1\x94\x00\x00\x00\x00\x00\x00\x00g\xc6\fc\xa26\xd8\xdf\xef\xf7\x9c\x1a\xef\x8am\x8b7\xcf\xc5\xa6\xf4\f\xabj%Y\xa9\xdd\x0e9e\xba\xec\x99@\xd2', 0x0)
executing program 6:
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0x0}, 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r0, <r1=>0xffffffffffffffff}, 0x4)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x19, &(0x7f0000000940)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc)
executing program 4:
syz_io_uring_setup(0x3b, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$mtd(0x0, 0x0, 0x101c02)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5)
ioctl$MEMREADOOB(r0, 0xc0104d04, &(0x7f0000000080)={0x7fffffff, 0x0, 0x0})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11, 21, 11, 23, 5, 27]
detailed listing:
executing program 4:
syz_io_uring_setup(0x3b, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$mtd(0x0, 0x0, 0x101c02)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5)
ioctl$MEMREADOOB(r0, 0xc0104d04, &(0x7f0000000080)={0x7fffffff, 0x0, 0x0})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <7>
bisect: split chunk #0 of len 7 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 5, 27]
detailed listing:
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11, 21, 11]
detailed listing:
executing program 4:
syz_io_uring_setup(0x3b, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$mtd(0x0, 0x0, 0x101c02)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5)
ioctl$MEMREADOOB(r0, 0xc0104d04, &(0x7f0000000080)={0x7fffffff, 0x0, 0x0})
executing program 6:
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40801, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000140)='./file1\x00')
r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)

program did not crash
bisect: split chunks (needed=true): <4>, <3>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 11, 23, 5, 27]
detailed listing:
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 11, 27]
detailed listing:
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet(0x2, 0x1, 0x100)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0xfffffffffffffef3, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000001cc0), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d06, &(0x7f0000002180))
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r5, 0x6a98047402e98331, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x48c6)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f0000004900)=[{{&(0x7f0000000480)=@xdp, 0x0, &(0x7f0000000680), 0x0, &(0x7f0000000740)=""/245}, 0x8}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @host}, 0x0, &(0x7f0000001d00)=[{&(0x7f00000008c0)=""/247}, {&(0x7f00000009c0)=""/99}, {&(0x7f0000000c00)=""/4094}, {&(0x7f0000001c00)=""/88}, {&(0x7f0000001c80)=""/21}], 0x0, &(0x7f0000001d40)=""/49}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @local}, 0x0, &(0x7f0000003540)=[{&(0x7f0000001e00)=""/38}, {&(0x7f00000021c0)=""/4096}, {&(0x7f00000031c0)=""/123}, {&(0x7f0000003240)=""/194}, {&(0x7f0000003340)=""/234}, {&(0x7f0000003440)=""/165}, {&(0x7f0000003500)=""/59}], 0x0, &(0x7f0000003580)=""/180}, 0x6}, {{&(0x7f0000003640)=@l2, 0x0, &(0x7f0000004700)=[{&(0x7f00000036c0)=""/52}, {&(0x7f0000003700)=""/4096}]}, 0x2}, {{&(0x7f0000004740)=@nfc, 0x0, &(0x7f00000048c0)=[{&(0x7f00000047c0)=""/177}, {&(0x7f0000004880)}]}, 0x9}], 0x10133, 0x2, 0x0)
r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
r7 = gettid()
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r7}}}], 0x18}}], 0x1, 0x800)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x73}, "14bffd076773e618d39a90a7ddede0f1cbbfb5400507109f248002f538054f1d79f119c666d26733442cafd720bdb2541415da118792c9c7d05d58719ec0d92263e2739da7bc6b092a07f4122aea955b70195af1efcdf25f4a45cf1e36245c76d420b0a64fd997374c6ac536273d1c80341fe9"}, 0x77)
tkill(r7, 0xb)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 11, 23, 5]
detailed listing:
executing program 1:
r0 = open(0x0, 0x0, 0x109)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000)
setpriority(0x0, 0x1, 0xa7a8)
futex(0x0, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc)
fremovexattr(r0, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
close(r3)
socket$l2tp6(0xa, 0x2, 0x73)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@local, 0x3, 0x1, 0x1, 0x1, 0x8}, 0x20)
bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff", 0x12)
syz_open_dev$ttys(0xc, 0x2, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000300)=0xa, 0x4)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 23, 5]
detailed listing:
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7})
io_setup(0x2, &(0x7f0000000000))
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e)
syz_open_dev$vbi(0x0, 0x0, 0x2)
ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 5]
detailed listing:
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
syz_emit_ethernet(0x2a, 0x0, 0x0)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 5]
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5]
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)="5fd310", 0x3)

program crashed: memory leak in gadget_bind
minimized 11 calls -> 6 calls
minimizing program #1 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 4]
detailed listing:
executing program 4:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3]
detailed listing:
executing program 4:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 2]
detailed listing:
executing program 4:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000450)='devtmpfs\x00', 0x0, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 2]
detailed listing:
executing program 4:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program crashed: memory leak in gadget_bind
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 1]
detailed listing:
executing program 4:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program crashed: memory leak in gadget_bind
minimized 5 calls -> 1 calls
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program crashed: memory leak in gadget_bind
bisect: concatenation succeeded
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000400)='dummy_udc.0', 0xb)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(0x0, 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400), 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e090300010001020001090227000101"], 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, 0x0, 0x0)

program did not crash
testing program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program crashed: memory leak in gadget_bind
extracting C reproducer
testing compiled C program (duration=1m39.16561293s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
simplifying C reproducer
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program did not crash
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing compiled C program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
program crashed: memory leak in gadget_bind
testing program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program crashed: memory leak in gadget_bind
validation run: crashed=true
testing program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program crashed: memory leak in gadget_bind
validation run: crashed=true
testing program (duration=1m39.16561293s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-write-openat-write-syz_usb_connect
detailed listing:
executing program 0:
mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb)
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program crashed: memory leak in gadget_bind
validation run: crashed=true
reproducing took 3h47m23.568225581s
repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff88812a3ea300 (size 128):
  comm "syz.0.17", pid 6069, jiffies 4294943967
  hex dump (first 32 bytes):
    00 a3 3e 2a 81 88 ff ff 00 a3 3e 2a 81 88 ff ff  ..>*......>*....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc a802af15):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
    raw_ioctl+0xad7/0x10c0 drivers/usb/gadget/legacy/raw_gadget.c:1307
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94

BUG: memory leak
unreferenced object 0xffff888127815480 (size 128):
  comm "syz.6.23", pid 6074, jiffies 4294944011
  hex dump (first 32 bytes):
    80 54 81 27 81 88 ff ff 80 54 81 27 81 88 ff ff  .T.'.....T.'....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc fd9d10f8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3772
    usb_add_gadget+0x221/0x330 drivers/usb/gadget/udc/core.c:1461
    usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1517 [inline]
    usb_add_gadget_udc+0x6e/0xb0 drivers/usb/gadget/udc/core.c:1564

BUG: memory leak
unreferenced object 0xffff88812a6d5600 (size 128):
  comm "syz.5.22", pid 6077, jiffies 4294944018
  hex dump (first 32 bytes):
    00 56 6d 2a 81 88 ff ff 00 56 6d 2a 81 88 ff ff  .Vm*.....Vm*....
    30 40 49 03 81 88 ff ff b8 4c 34 12 81 88 ff ff  0@I......L4.....
  backtrace (crc e492b8c):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3772
    usb_add_gadget+0x221/0x330 drivers/usb/gadget/udc/core.c:1461
    usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1517 [inline]
    usb_add_gadget_udc+0x6e/0xb0 drivers/usb/gadget/udc/core.c:1564

BUG: memory leak
unreferenced object 0xffff88812a6d5080 (size 128):
  comm "syz.0.26", pid 6083, jiffies 4294944267
  hex dump (first 32 bytes):
    80 50 6d 2a 81 88 ff ff 80 50 6d 2a 81 88 ff ff  .Pm*.....Pm*....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc b6755c66):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
    raw_ioctl+0xad7/0x10c0 drivers/usb/gadget/legacy/raw_gadget.c:1307
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

final repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff88812a3ea300 (size 128):
  comm "syz.0.17", pid 6069, jiffies 4294943967
  hex dump (first 32 bytes):
    00 a3 3e 2a 81 88 ff ff 00 a3 3e 2a 81 88 ff ff  ..>*......>*....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc a802af15):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
    raw_ioctl+0xad7/0x10c0 drivers/usb/gadget/legacy/raw_gadget.c:1307
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94

BUG: memory leak
unreferenced object 0xffff888127815480 (size 128):
  comm "syz.6.23", pid 6074, jiffies 4294944011
  hex dump (first 32 bytes):
    80 54 81 27 81 88 ff ff 80 54 81 27 81 88 ff ff  .T.'.....T.'....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc fd9d10f8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3772
    usb_add_gadget+0x221/0x330 drivers/usb/gadget/udc/core.c:1461
    usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1517 [inline]
    usb_add_gadget_udc+0x6e/0xb0 drivers/usb/gadget/udc/core.c:1564

BUG: memory leak
unreferenced object 0xffff88812a6d5600 (size 128):
  comm "syz.5.22", pid 6077, jiffies 4294944018
  hex dump (first 32 bytes):
    00 56 6d 2a 81 88 ff ff 00 56 6d 2a 81 88 ff ff  .Vm*.....Vm*....
    30 40 49 03 81 88 ff ff b8 4c 34 12 81 88 ff ff  0@I......L4.....
  backtrace (crc e492b8c):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3772
    usb_add_gadget+0x221/0x330 drivers/usb/gadget/udc/core.c:1461
    usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1517 [inline]
    usb_add_gadget_udc+0x6e/0xb0 drivers/usb/gadget/udc/core.c:1564

BUG: memory leak
unreferenced object 0xffff88812a6d5080 (size 128):
  comm "syz.0.26", pid 6083, jiffies 4294944267
  hex dump (first 32 bytes):
    80 50 6d 2a 81 88 ff ff 80 50 6d 2a 81 88 ff ff  .Pm*.....Pm*....
    30 40 49 03 81 88 ff ff 00 00 00 00 00 00 00 00  0@I.............
  backtrace (crc b6755c66):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    gadget_bind+0x67/0x230 drivers/usb/gadget/legacy/raw_gadget.c:294
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
    raw_ioctl+0xad7/0x10c0 drivers/usb/gadget/legacy/raw_gadget.c:1307
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF