Extracting prog: 3h35m29.852126276s Minimizing prog: 28m39.775042131s Simplifying prog options: 0s Extracting C: 38.197151744s Simplifying C: 10m40.521436957s extracting reproducer from 67 programs testing a last program of every proc single: executing 17 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_80211_inject_frame detailed listing: executing program 0: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_STRING detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL detailed listing: executing program 0: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2 detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_G_SELECTION-socket$nl_generic-setitimer-syz_genetlink_get_family_id$nl80211-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_START_AP-syz_open_dev$loop-socket$nl_xfrm-sendmsg$nl_xfrm-syz_usb_connect-socket$inet_icmp_raw-connect$inet-socket$inet_icmp_raw-syz_emit_ethernet-io_uring_register$IORING_REGISTER_BUFFERS-io_uring_setup-io_uring_register$IORING_REGISTER_FILES-unshare-open-ioctl$FICLONERANGE-close_range-socket$inet6_mptcp-getsockopt$inet6_mptcp_buf detailed listing: executing program 0: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-socket-openat$tun-ioctl$TUNSETIFF-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$unix-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_S_FMT-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-pipe2-socketpair$unix-setsockopt$sock_int-splice-write$FUSE_INIT-openat$tun-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) program did not crash single: failed to extract reproducer bisect: bisecting 67 programs with base timeout 30s testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2, 10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8, 6, 9, 5, 8, 6, 10, 10, 3, 11, 4, 6, 7, 9, 7, 2, 6, 6, 2, 9, 2, 5, 2, 7, 2, 5, 14, 2, 2, 4, 6, 2, 2, 2, 7, 5, 4, 3, 4, 3, 3, 9, 2, 6, 1] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 7: r0 = socket$kcm(0x2, 0x200000000000001, 0x106) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) nanosleep(0x0, &(0x7f0000000480)) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300000000050c000480080001000000000114000000110001"], 0x88}}, 0x0) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000019c0)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 37: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 9: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1ea, 0x0, &(0x7f0000000340)="b461802305624431ed3373010000003d2600906919d5d5fe00c6fc7ef8eef9757a601fee936390009c5bbd000000003632b69f0eb2062818f2980660abbc6f6322cbfac48000d75bfab0cd655ba6f12c02869ec5254594d7d144c39e3200000000d76a6100810800ffff000000000000e6b2347d38650608e39d2f8e612f5787cfb4d8b5808cf339089d46844de51517a756705ab535c084ee3da160dffccccbc132908c2d4588aec206fc5ae73940dfd5387542e810faec0a2bab2619a5fe6137560a30311f9f2624cf08fea2910ba57ba7d147616e4171dda39c4f5c53be33fc65cdf551d7f35f4b5ce952e9afe51be2affb21872637fc69f502ae580d359e354fc7b3d847e0aae75529322827125c768dd3864745c27922ab3ab830d3c114dc3b3a80e39819460ef63c1a341d5a33ade0749c6dea4d84e2d8c780eb4415be96e5b1e11864782077088534c4a60cc5a68e238ffa59770fc19b1ed25e545ae107cb933ae8e3afcbd5ec28003b20d4c0a8d425d66cd6d208d43d29cbcdfb1cc0ef5f388bacdeed1f13ef597d20539507cf7d50301b1ae58c1a83b0d006000000659780d136c225dfbcf87f1e80065aad06b55b779e9789d9613f21757222d2d45eb7db09fd3af894460bf93d333e4c62c8b4d73ee1310d0ecbfddf57408de7764032e91d14d931a8943b", 0x0, 0x3f95b0e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(0x0, 0x6f5e, 0x3) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) executing program 9: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./meta.img\x00', 0x42, 0x1b6) ftruncate(r0, 0x2000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./data.img\x00', 0x42, 0x1b6) ftruncate(r1, 0x4000000) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) r3 = syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./control\x00', 0x81b6, 0xaec) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000747000"/306) executing program 9: r0 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='source\x00', &(0x7f0000000380)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='mount_timeout\x00', &(0x7f0000000400)='0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) r2 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 9: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040950b801701000102030109022700010100a0320904000003ff00000007058202400000070502024000000705810308000b"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000080)="6574683000000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f00000000c0)="6574683100000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000140)="6574683200000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000180)="7573623000000000000000000000000001000000") executing program 5: syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040f30c709100010102030109022e0001010080fa0904000004ff00000007050102000200070582020002000705830340000107050403400001"], 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 5: r0 = syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b0510000101020001090239000201008032090400000000000000090401000000000000090401010300000000070501024000000705810240000007058201900301"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000300)={0x100, 0x0, 0x1, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x88}}, 0x0) executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='auxv\x00') read(r0, &(0x7f0000000100), 0x1000) executing program 38: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9170, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f0000000220), &(0x7f0000000240), 0x18, 0xfffffffffffffffd) r1 = socket$rxrpc(0x2, 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x111, 0x2, &(0x7f0000000220)='syz\x00', 0x4) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000500)="000000000000000000000001060000020000000100000002000000010000000000000000", 0x24) read(r2, &(0x7f0000000308), 0x24) sendto$inet(r0, &(0x7f0000000300), 0x2c, 0x0, &(0x7f00000000e0)={0x2, 0x1234, @loopback}, 0x10) recvfrom$inet(r0, &(0x7f0000000600)=""/256, 0x100, 0x0, 0x0, 0x0) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./f0\x00', 0x42, 0x1b6) ioctl(r0, 0xc138fd03, &(0x7f0000000040)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573742d636163686500"/312) executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000040)=0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x1}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a05040200"], 0x88}}, 0x0) executing program 8: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/1000, 0x3e8) executing program 8: madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x7, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020020000000001600000001000000") executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1}, 0x0) executing program 1: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) executing program 2: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x2, 0x0) fcntl$dupfd(r0, 0x0, 0x0) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) read(r0, &(0x7f0000000600)=""/1024, 0x400) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) executing program 8: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash replaying the whole log did not cause a kernel crash single: executing 17 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_80211_inject_frame detailed listing: executing program 0: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_STRING detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL detailed listing: executing program 0: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2 detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_G_SELECTION-socket$nl_generic-setitimer-syz_genetlink_get_family_id$nl80211-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_START_AP-syz_open_dev$loop-socket$nl_xfrm-sendmsg$nl_xfrm-syz_usb_connect-socket$inet_icmp_raw-connect$inet-socket$inet_icmp_raw-syz_emit_ethernet-io_uring_register$IORING_REGISTER_BUFFERS-io_uring_setup-io_uring_register$IORING_REGISTER_FILES-unshare-open-ioctl$FICLONERANGE-close_range-socket$inet6_mptcp-getsockopt$inet6_mptcp_buf detailed listing: executing program 0: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-socket-openat$tun-ioctl$TUNSETIFF-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$unix-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_S_FMT-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-pipe2-socketpair$unix-setsockopt$sock_int-splice-write$FUSE_INIT-openat$tun-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) program did not crash single: failed to extract reproducer bisect: bisecting 67 programs with base timeout 1m40s testing program (duration=1m56s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2, 10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8, 6, 9, 5, 8, 6, 10, 10, 3, 11, 4, 6, 7, 9, 7, 2, 6, 6, 2, 9, 2, 5, 2, 7, 2, 5, 14, 2, 2, 4, 6, 2, 2, 2, 7, 5, 4, 3, 4, 3, 3, 9, 2, 6, 1] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 7: r0 = socket$kcm(0x2, 0x200000000000001, 0x106) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) nanosleep(0x0, &(0x7f0000000480)) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300000000050c000480080001000000000114000000110001"], 0x88}}, 0x0) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000019c0)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 37: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 9: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1ea, 0x0, &(0x7f0000000340)="b461802305624431ed3373010000003d2600906919d5d5fe00c6fc7ef8eef9757a601fee936390009c5bbd000000003632b69f0eb2062818f2980660abbc6f6322cbfac48000d75bfab0cd655ba6f12c02869ec5254594d7d144c39e3200000000d76a6100810800ffff000000000000e6b2347d38650608e39d2f8e612f5787cfb4d8b5808cf339089d46844de51517a756705ab535c084ee3da160dffccccbc132908c2d4588aec206fc5ae73940dfd5387542e810faec0a2bab2619a5fe6137560a30311f9f2624cf08fea2910ba57ba7d147616e4171dda39c4f5c53be33fc65cdf551d7f35f4b5ce952e9afe51be2affb21872637fc69f502ae580d359e354fc7b3d847e0aae75529322827125c768dd3864745c27922ab3ab830d3c114dc3b3a80e39819460ef63c1a341d5a33ade0749c6dea4d84e2d8c780eb4415be96e5b1e11864782077088534c4a60cc5a68e238ffa59770fc19b1ed25e545ae107cb933ae8e3afcbd5ec28003b20d4c0a8d425d66cd6d208d43d29cbcdfb1cc0ef5f388bacdeed1f13ef597d20539507cf7d50301b1ae58c1a83b0d006000000659780d136c225dfbcf87f1e80065aad06b55b779e9789d9613f21757222d2d45eb7db09fd3af894460bf93d333e4c62c8b4d73ee1310d0ecbfddf57408de7764032e91d14d931a8943b", 0x0, 0x3f95b0e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(0x0, 0x6f5e, 0x3) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) executing program 9: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./meta.img\x00', 0x42, 0x1b6) ftruncate(r0, 0x2000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./data.img\x00', 0x42, 0x1b6) ftruncate(r1, 0x4000000) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) r3 = syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./control\x00', 0x81b6, 0xaec) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000747000"/306) executing program 9: r0 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='source\x00', &(0x7f0000000380)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='mount_timeout\x00', &(0x7f0000000400)='0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) r2 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 9: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040950b801701000102030109022700010100a0320904000003ff00000007058202400000070502024000000705810308000b"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000080)="6574683000000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f00000000c0)="6574683100000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000140)="6574683200000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000180)="7573623000000000000000000000000001000000") executing program 5: syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040f30c709100010102030109022e0001010080fa0904000004ff00000007050102000200070582020002000705830340000107050403400001"], 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 5: r0 = syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b0510000101020001090239000201008032090400000000000000090401000000000000090401010300000000070501024000000705810240000007058201900301"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000300)={0x100, 0x0, 0x1, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x88}}, 0x0) executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='auxv\x00') read(r0, &(0x7f0000000100), 0x1000) executing program 38: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9170, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f0000000220), &(0x7f0000000240), 0x18, 0xfffffffffffffffd) r1 = socket$rxrpc(0x2, 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x111, 0x2, &(0x7f0000000220)='syz\x00', 0x4) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000500)="000000000000000000000001060000020000000100000002000000010000000000000000", 0x24) read(r2, &(0x7f0000000308), 0x24) sendto$inet(r0, &(0x7f0000000300), 0x2c, 0x0, &(0x7f00000000e0)={0x2, 0x1234, @loopback}, 0x10) recvfrom$inet(r0, &(0x7f0000000600)=""/256, 0x100, 0x0, 0x0, 0x0) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./f0\x00', 0x42, 0x1b6) ioctl(r0, 0xc138fd03, &(0x7f0000000040)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573742d636163686500"/312) executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000040)=0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x1}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a05040200"], 0x88}}, 0x0) executing program 8: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/1000, 0x3e8) executing program 8: madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x7, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020020000000001600000001000000") executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1}, 0x0) executing program 1: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) executing program 2: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x2, 0x0) fcntl$dupfd(r0, 0x0, 0x0) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) read(r0, &(0x7f0000000600)=""/1024, 0x400) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) executing program 8: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash replaying the whole log did not cause a kernel crash single: executing 17 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_80211_inject_frame detailed listing: executing program 0: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_STRING detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL detailed listing: executing program 0: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2 detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-read-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-read-write$USERIO_CMD_SEND_INTERRUPT-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_G_SELECTION-socket$nl_generic-setitimer-syz_genetlink_get_family_id$nl80211-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_START_AP-syz_open_dev$loop-socket$nl_xfrm-sendmsg$nl_xfrm-syz_usb_connect-socket$inet_icmp_raw-connect$inet-socket$inet_icmp_raw-syz_emit_ethernet-io_uring_register$IORING_REGISTER_BUFFERS-io_uring_setup-io_uring_register$IORING_REGISTER_FILES-unshare-open-ioctl$FICLONERANGE-close_range-socket$inet6_mptcp-getsockopt$inet6_mptcp_buf detailed listing: executing program 0: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-socket-openat$tun-ioctl$TUNSETIFF-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$unix-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_S_FMT-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-pipe2-socketpair$unix-setsockopt$sock_int-splice-write$FUSE_INIT-openat$tun-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) program did not crash single: failed to extract reproducer bisect: bisecting 67 programs with base timeout 6m0s testing program (duration=6m16s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2, 10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8, 6, 9, 5, 8, 6, 10, 10, 3, 11, 4, 6, 7, 9, 7, 2, 6, 6, 2, 9, 2, 5, 2, 7, 2, 5, 14, 2, 2, 4, 6, 2, 2, 2, 7, 5, 4, 3, 4, 3, 3, 9, 2, 6, 1] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 7: r0 = socket$kcm(0x2, 0x200000000000001, 0x106) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) nanosleep(0x0, &(0x7f0000000480)) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300000000050c000480080001000000000114000000110001"], 0x88}}, 0x0) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000019c0)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 37: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 9: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1ea, 0x0, &(0x7f0000000340)="b461802305624431ed3373010000003d2600906919d5d5fe00c6fc7ef8eef9757a601fee936390009c5bbd000000003632b69f0eb2062818f2980660abbc6f6322cbfac48000d75bfab0cd655ba6f12c02869ec5254594d7d144c39e3200000000d76a6100810800ffff000000000000e6b2347d38650608e39d2f8e612f5787cfb4d8b5808cf339089d46844de51517a756705ab535c084ee3da160dffccccbc132908c2d4588aec206fc5ae73940dfd5387542e810faec0a2bab2619a5fe6137560a30311f9f2624cf08fea2910ba57ba7d147616e4171dda39c4f5c53be33fc65cdf551d7f35f4b5ce952e9afe51be2affb21872637fc69f502ae580d359e354fc7b3d847e0aae75529322827125c768dd3864745c27922ab3ab830d3c114dc3b3a80e39819460ef63c1a341d5a33ade0749c6dea4d84e2d8c780eb4415be96e5b1e11864782077088534c4a60cc5a68e238ffa59770fc19b1ed25e545ae107cb933ae8e3afcbd5ec28003b20d4c0a8d425d66cd6d208d43d29cbcdfb1cc0ef5f388bacdeed1f13ef597d20539507cf7d50301b1ae58c1a83b0d006000000659780d136c225dfbcf87f1e80065aad06b55b779e9789d9613f21757222d2d45eb7db09fd3af894460bf93d333e4c62c8b4d73ee1310d0ecbfddf57408de7764032e91d14d931a8943b", 0x0, 0x3f95b0e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(0x0, 0x6f5e, 0x3) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) executing program 9: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./meta.img\x00', 0x42, 0x1b6) ftruncate(r0, 0x2000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./data.img\x00', 0x42, 0x1b6) ftruncate(r1, 0x4000000) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) r3 = syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./control\x00', 0x81b6, 0xaec) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000747000"/306) executing program 9: r0 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='source\x00', &(0x7f0000000380)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='mount_timeout\x00', &(0x7f0000000400)='0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) r2 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 9: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040950b801701000102030109022700010100a0320904000003ff00000007058202400000070502024000000705810308000b"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000080)="6574683000000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f00000000c0)="6574683100000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000140)="6574683200000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000180)="7573623000000000000000000000000001000000") executing program 5: syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040f30c709100010102030109022e0001010080fa0904000004ff00000007050102000200070582020002000705830340000107050403400001"], 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 5: r0 = syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b0510000101020001090239000201008032090400000000000000090401000000000000090401010300000000070501024000000705810240000007058201900301"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000300)={0x100, 0x0, 0x1, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x88}}, 0x0) executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='auxv\x00') read(r0, &(0x7f0000000100), 0x1000) executing program 38: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9170, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f0000000220), &(0x7f0000000240), 0x18, 0xfffffffffffffffd) r1 = socket$rxrpc(0x2, 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x111, 0x2, &(0x7f0000000220)='syz\x00', 0x4) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000500)="000000000000000000000001060000020000000100000002000000010000000000000000", 0x24) read(r2, &(0x7f0000000308), 0x24) sendto$inet(r0, &(0x7f0000000300), 0x2c, 0x0, &(0x7f00000000e0)={0x2, 0x1234, @loopback}, 0x10) recvfrom$inet(r0, &(0x7f0000000600)=""/256, 0x100, 0x0, 0x0, 0x0) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./f0\x00', 0x42, 0x1b6) ioctl(r0, 0xc138fd03, &(0x7f0000000040)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573742d636163686500"/312) executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000040)=0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x1}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a05040200"], 0x88}}, 0x0) executing program 8: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/1000, 0x3e8) executing program 8: madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x7, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020020000000001600000001000000") executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1}, 0x0) executing program 1: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) executing program 2: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x2, 0x0) fcntl$dupfd(r0, 0x0, 0x0) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) read(r0, &(0x7f0000000600)=""/1024, 0x400) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) executing program 8: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program crashed: KASAN: slab-use-after-free Read in str_to_user bisect: bisecting 67 programs bisect: split chunks (needed=false): <67> bisect: split chunk #0 of len 67 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 9, 5, 8, 6, 10, 10, 3, 11, 4, 6, 7, 9, 7, 2, 6, 6, 2, 9, 2, 5, 2, 7, 2, 5, 14, 2, 2, 4, 6, 2, 2, 2, 7, 5, 4, 3, 4, 3, 3, 9, 2, 6, 1] detailed listing: executing program 7: r0 = socket$kcm(0x2, 0x200000000000001, 0x106) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) nanosleep(0x0, &(0x7f0000000480)) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300000000050c000480080001000000000114000000110001"], 0x88}}, 0x0) executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000019c0)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 7: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 37: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 9: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1ea, 0x0, &(0x7f0000000340)="b461802305624431ed3373010000003d2600906919d5d5fe00c6fc7ef8eef9757a601fee936390009c5bbd000000003632b69f0eb2062818f2980660abbc6f6322cbfac48000d75bfab0cd655ba6f12c02869ec5254594d7d144c39e3200000000d76a6100810800ffff000000000000e6b2347d38650608e39d2f8e612f5787cfb4d8b5808cf339089d46844de51517a756705ab535c084ee3da160dffccccbc132908c2d4588aec206fc5ae73940dfd5387542e810faec0a2bab2619a5fe6137560a30311f9f2624cf08fea2910ba57ba7d147616e4171dda39c4f5c53be33fc65cdf551d7f35f4b5ce952e9afe51be2affb21872637fc69f502ae580d359e354fc7b3d847e0aae75529322827125c768dd3864745c27922ab3ab830d3c114dc3b3a80e39819460ef63c1a341d5a33ade0749c6dea4d84e2d8c780eb4415be96e5b1e11864782077088534c4a60cc5a68e238ffa59770fc19b1ed25e545ae107cb933ae8e3afcbd5ec28003b20d4c0a8d425d66cd6d208d43d29cbcdfb1cc0ef5f388bacdeed1f13ef597d20539507cf7d50301b1ae58c1a83b0d006000000659780d136c225dfbcf87f1e80065aad06b55b779e9789d9613f21757222d2d45eb7db09fd3af894460bf93d333e4c62c8b4d73ee1310d0ecbfddf57408de7764032e91d14d931a8943b", 0x0, 0x3f95b0e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(0x0, 0x6f5e, 0x3) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) executing program 9: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./meta.img\x00', 0x42, 0x1b6) ftruncate(r0, 0x2000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./data.img\x00', 0x42, 0x1b6) ftruncate(r1, 0x4000000) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) r3 = syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./control\x00', 0x81b6, 0xaec) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000747000"/306) executing program 9: r0 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='source\x00', &(0x7f0000000380)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='mount_timeout\x00', &(0x7f0000000400)='0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) executing program 9: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) r2 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8910, &(0x7f0000000200)='\x00'/32) ioctl(r2, 0x8913, &(0x7f0000000200)) executing program 9: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040950b801701000102030109022700010100a0320904000003ff00000007058202400000070502024000000705810308000b"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000080)="6574683000000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f00000000c0)="6574683100000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000140)="6574683200000000000000000000000001000000") ioctl(r0, 0x8914, &(0x7f0000000180)="7573623000000000000000000000000001000000") executing program 5: syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040f30c709100010102030109022e0001010080fa0904000004ff00000007050102000200070582020002000705830340000107050403400001"], 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 5: r0 = syz_usb_connect(0x0, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b0510000101020001090239000201008032090400000000000000090401000000000000090401010300000000070501024000000705810240000007058201900301"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000300)={0x100, 0x0, 0x1, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_START(r1, 0x6f29) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x88}}, 0x0) executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='auxv\x00') read(r0, &(0x7f0000000100), 0x1000) executing program 38: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xaa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x32, 0x5, 0x57e, 0x306}}, 0x14a) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9170, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f0000000220), &(0x7f0000000240), 0x18, 0xfffffffffffffffd) r1 = socket$rxrpc(0x2, 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x111, 0x2, &(0x7f0000000220)='syz\x00', 0x4) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000500)="000000000000000000000001060000020000000100000002000000010000000000000000", 0x24) read(r2, &(0x7f0000000308), 0x24) sendto$inet(r0, &(0x7f0000000300), 0x2c, 0x0, &(0x7f00000000e0)={0x2, 0x1234, @loopback}, 0x10) recvfrom$inet(r0, &(0x7f0000000600)=""/256, 0x100, 0x0, 0x0, 0x0) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./f0\x00', 0x42, 0x1b6) ioctl(r0, 0xc138fd03, &(0x7f0000000040)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573742d636163686500"/312) executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000040)=0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x1}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a05040200"], 0x88}}, 0x0) executing program 8: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/1000, 0x3e8) executing program 8: madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x7, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020020000000001600000001000000") executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1}, 0x0) executing program 1: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) executing program 2: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x2, 0x0) fcntl$dupfd(r0, 0x0, 0x0) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) read(r0, &(0x7f0000000600)=""/1024, 0x400) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) executing program 8: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m11s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2, 10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8, 2, 5, 14, 2, 2, 4, 6, 2, 2, 2, 7, 5, 4, 3, 4, 3, 3, 9, 2, 6, 1] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f0000000220), &(0x7f0000000240), 0x18, 0xfffffffffffffffd) r1 = socket$rxrpc(0x2, 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x111, 0x2, &(0x7f0000000220)='syz\x00', 0x4) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom$inet(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000500)="000000000000000000000001060000020000000100000002000000010000000000000000", 0x24) read(r2, &(0x7f0000000308), 0x24) sendto$inet(r0, &(0x7f0000000300), 0x2c, 0x0, &(0x7f00000000e0)={0x2, 0x1234, @loopback}, 0x10) recvfrom$inet(r0, &(0x7f0000000600)=""/256, 0x100, 0x0, 0x0, 0x0) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./f0\x00', 0x42, 0x1b6) ioctl(r0, 0xc138fd03, &(0x7f0000000040)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573742d636163686500"/312) executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000040)=0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x1}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a05040200"], 0x88}}, 0x0) executing program 8: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/1000, 0x3e8) executing program 8: madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x7, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xc, 0x4, 0x280, 0xffffffff, 0x148, 0x0, 0x4000000, 0x98, 0xffffffff, 0x1e8, 0x1e8, 0x1e8, 0x98, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x1000}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x3ff}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f000002"], 0x9c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000100)="280000010000007f00000106b7", 0xd, 0x0, &(0x7f0000000200)={0x2, 0x6b7, @loopback}, 0x10) executing program 8: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020020000000001600000001000000") executing program 1: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1}, 0x0) executing program 1: syz_usb_connect(0x1, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12011002000000402505a4a400000000000109022000010100c0000904000002ff0000000705810200020007050202000200"], &(0x7f0000000200)={0x0, 0x0, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="050f0f00010a1003000e0001000000"]}) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000400), 0x15, 0x2) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000100)=@usbdevfs_driver={0x0, 0xc01c5564, &(0x7f0000000600)="090000000100"/28}) executing program 2: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x2, 0x0) fcntl$dupfd(r0, 0x0, 0x0) executing program 8: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) read(r0, &(0x7f0000000600)=""/1024, 0x400) executing program 8: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='invalid\x00', 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a3100"], 0x88}}, 0x0) executing program 8: syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0103ffff0000000000000000000001000000000000000000003d1624000000000000000000000000000000000000000000bf0c91718033fae000fae000c005012a000000ff16230000080000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2, 10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: split chunks (needed=true): <23> bisect: split chunk #0 of len 23 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 4, 4, 10, 1, 8, 15, 5, 9, 8, 8] detailed listing: executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 34: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 35: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 3: nanosleep(&(0x7f0000000040)={0x0, 0x5f5e100}, 0x0) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xffffffff) write$ppp(r0, &(0x7f0000000200)="12060000004000"/22, 0x16) ioctl(r0, 0x4010744d, &(0x7f0000000100)="00020000007f00001600000001000000") ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000400)=0x40) write$ppp(r0, &(0x7f0000000500)="80fd0201000a120600000040", 0xc) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000800)=0xc0) write$ppp(r0, &(0x7f0000000900)="80fd0f010004", 0x6) executing program 3: read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) read(0xffffffffffffffff, &(0x7f0000000400)=""/24, 0x18) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) executing program 3: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) executing program 36: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) read(r0, &(0x7f0000000400), 0x1) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17, 3, 23, 1, 6, 2, 2] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: split chunks (needed=true): <12> bisect: split chunk #0 of len 12 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 23, 1, 6, 2, 2] detailed listing: executing program 6: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) executing program 4: r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000780)={0x34, &(0x7f0000000600)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000f00)={0x34, &(0x7f0000000cc0)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001240)={0x34, &(0x7f0000001080)={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001700)={0x34, &(0x7f0000001500)={0x20, 0x18, 0x1, ')'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001a00)={0x34, &(0x7f0000001900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001d00)={0x34, &(0x7f0000001c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002180)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000500)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000009c0)={0x34, &(0x7f00000008c0)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002540)={0x34, &(0x7f0000002340)={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002800)={0x34, &(0x7f0000002700)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002b00)={0x34, &(0x7f0000002a00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002e00)={0x34, &(0x7f0000002d00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003100)={0x34, &(0x7f0000003000)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003400)={0x34, &(0x7f0000003300)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003700)={0x34, &(0x7f0000003600)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003a00)={0x34, &(0x7f0000003900)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000003d00)={0x34, &(0x7f0000003c00)={0x40, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 4: nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x7, 0x6, 0x8, 0x2, 0x6, 0xffff8000}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0xeeef0000, 0x75000, 0xd, 0xcc, 0x16, 0x40, 0x51, 0x6, 0x8, 0x7f, 0xd, 0x8}, {0x200000, 0xa000, 0xa, 0x7b, 0x16, 0x18, 0x0, 0x5, 0x1, 0x3, 0x5, 0x1}, {0xb000, 0x576463a100692f35, 0xb, 0x0, 0x4, 0x6, 0x7c, 0x0, 0x1, 0x8, 0x1, 0x4}, {0xffffffff, 0xe000, 0xe, 0x0, 0xa9, 0x7, 0x53, 0x49, 0x8, 0x2, 0x0, 0x7}, {0x80a0000, 0x50000, 0xc, 0x7, 0x4e, 0x9b, 0x9, 0x8, 0x0, 0xe4, 0x9, 0x40}, {0x4000, 0xeeee0000, 0xf, 0xe, 0x5, 0x40, 0x2a, 0x0, 0x5, 0x8, 0x81, 0x2}, {0x8000000, 0xa000, 0xb, 0x51, 0x1, 0x7f, 0x5, 0x4, 0x5, 0x16, 0x2}, {0xfec00000, 0x3000, 0xe, 0x6, 0x10, 0x3, 0x5, 0x3, 0xf9, 0xf7, 0x8, 0x1}, {0x70000, 0x700}, {0x1, 0x6}, 0x0, 0x0, 0xd000, 0x26610, 0x8, 0x9400, 0xffefc002, [0xff, 0x100000000, 0xd, 0x6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0}}]}, 0x13c}}, 0x0) executing program 4: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='key\x00', &(0x7f0000000200)='test\x00', 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 10, 23, 9, 17] detailed listing: executing program 32: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'sit0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0x8000a, 0x2000, 0x200e, 0x9, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r7, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r5, 0x0, r7, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r6, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) executing program 33: r0 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e1, 0x1000, 0x80000003, 0x2d7}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x73, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f0000000200)={0x0, 0x0, 0x101, 0x2, {0x2b5b, 0x5, 0x7, 0xc}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000001c0)={{0x77359400}, {0x0, 0xea60}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r5, 0x45d5a24f61177641, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x2, 0x5d, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x4080) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0xc800) sendmsg$NL80211_CMD_START_AP(r2, 0x0, 0x0) syz_open_dev$loop(0x0, 0xf01c, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0xfffa, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f0000000100)={@random="99fb5e31c591", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0xd, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1) r8 = io_uring_setup(0x7625, &(0x7f00000002c0)={0x0, 0xdfe4, 0x40, 0x4000, 0x1c9, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000280)=[r0], 0x1) unshare(0x22020600) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000c00)={{r9}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r10, 0x11c, 0x4, 0x0, 0x0) executing program 6: socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 9, 17] detailed listing: executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x1000) io_uring_enter(r3, 0x8a1, 0xb08a, 0x6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x1, 0x41) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c00002c000111000001f500010244132403b1fd606412c3258e3d67aa5b000100000000062c000000000000c1334d04000280040003"], 0x64}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r7, &(0x7f0000007480), 0x29e15b2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 6: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') unshare(0x40000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={'syzkaller1\x00', {0x2, 0x0, @private=0xa010101}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_FD={0x8, 0x1c, r0}]}, 0x28}}, 0x0) executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write-nanosleep detailed listing: executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 6: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write-nanosleep detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent bisect: concatenation succeeded found reproducer with 17 syscalls minimizing guilty program testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16) program crashed: KASAN: slab-use-after-free Read in str_to_user testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, 0x0, 0x0) program did not crash testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent simplifying C reproducer testing compiled C program (duration=1m22.5405755s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in input_dev_uevent a never seen crash title: KASAN: slab-use-after-free Read in input_dev_uevent, ignore testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in sysfs_emit a never seen crash title: KASAN: slab-use-after-free Read in sysfs_emit, ignore testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in input_dev_uevent a never seen crash title: KASAN: slab-use-after-free Read in input_dev_uevent, ignore testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in str_to_user testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true testing program (duration=1m22.5405755s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true reproducing took 4h22m30.663921198s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730 Read of size 1 at addr ffff888023755758 by task udevd/498 Read of size 1 at addr ffff888023755758 by task udevd/4984 CPU: 0 UID: 0 PID: 4984 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 string_nocheck lib/vsprintf.c:648 [inline] string+0x216/0x2d0 lib/vsprintf.c:730 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2949 add_uevent_var+0x1ce/0x460 lib/kobject_uevent.c:682 rc_dev_uevent+0x164/0x1a0 drivers/media/rc/rc-main.c:1632 dev_uevent+0x537/0x870 drivers/base/core.c:2783 uevent_show+0x1a0/0x310 drivers/base/core.c:2830 dev_attr_show+0x58/0xc0 drivers/base/core.c:2491 sysfs_kf_seq_show+0x331/0x490 fs/sysfs/file.c:65 seq_read_iter+0x463/0xca0 fs/seq_file.c:231 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x595/0xa80 fs/read_write.c:574 ksys_read+0x150/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd992ea7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffe6795ba80 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd993694880 RCX: 00007fd992ea7407 RDX: 0000000000001000 RSI: 000055ffb2af1300 RDI: 000000000000000c RBP: 00007fd992fefff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007fd992fefea0 R14: 0000000000000000 R15: 000055ffb2ade8a0 Allocated by task 5850: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5850: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x1c5/0x650 mm/slub.c:6792 redrat3_delete drivers/media/rc/redrat3.c:466 [inline] redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888023755000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1880 bytes inside of freed 2048-byte region [ffff888023755000, ffff888023755800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023750000 pfn:0x23750 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000240 ffff88801b042000 ffffea0000d37410 ffffea0001dde610 raw: ffff888023750000 0000000000080005 00000000f5000000 0000000000000000 head: 00fff00000000240 ffff88801b042000 ffffea0000d37410 ffffea0001dde610 head: ffff888023750000 0000000000080005 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5762, tgid 5762 (syz-executor), ts 104571741824 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545 kmalloc_reserve net/core/skbuff.c:637 [inline] pskb_expand_head+0x22c/0x13a0 net/core/skbuff.c:2315 netlink_trim+0x1b3/0x2c0 net/netlink/af_netlink.c:1300 netlink_broadcast_filtered+0x6d/0xea0 net/netlink/af_netlink.c:1518 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline] nlmsg_multicast include/net/netlink.h:1184 [inline] nlmsg_notify+0xe3/0x1a0 net/netlink/af_netlink.c:2599 __dev_notify_flags+0x257/0x510 net/core/dev.c:9849 rtnl_configure_link+0x2f5/0x510 net/core/rtnetlink.c:3732 veth_newlink+0x553/0xdd0 drivers/net/veth.c:1880 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969 __rtnl_newlink net/core/rtnetlink.c:4098 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215 page last free pid 5449 tgid 5449 ts 65960944953 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 __slab_free+0x274/0x2c0 mm/slub.c:5815 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x29f/0x600 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] tomoyo_init_log+0x112e/0x1fa0 security/tomoyo/audit.c:262 tomoyo_supervisor+0x35f/0x1560 security/tomoyo/common.c:2232 tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline] tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64 tomoyo_environ security/tomoyo/domain.c:673 [inline] tomoyo_find_next_domain+0x1332/0x1a90 security/tomoyo/domain.c:889 tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102 security_bprm_check+0x85/0x240 security/security.c:820 search_binary_handler fs/exec.c:1755 [inline] exec_binprm fs/exec.c:1797 [inline] bprm_execve+0x888/0x1590 fs/exec.c:1853 do_execveat_common+0x4f4/0x670 fs/exec.c:1951 __do_sys_execve fs/exec.c:2024 [inline] __se_sys_execve fs/exec.c:2018 [inline] __x64_sys_execve+0x97/0xc0 fs/exec.c:2018 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 Memory state around the buggy address: ffff888023755600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023755680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888023755700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888023755780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023755800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730 Read of size 1 at addr ffff888023755758 by task udevd/498 Read of size 1 at addr ffff888023755758 by task udevd/4984 CPU: 0 UID: 0 PID: 4984 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 string_nocheck lib/vsprintf.c:648 [inline] string+0x216/0x2d0 lib/vsprintf.c:730 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2949 add_uevent_var+0x1ce/0x460 lib/kobject_uevent.c:682 rc_dev_uevent+0x164/0x1a0 drivers/media/rc/rc-main.c:1632 dev_uevent+0x537/0x870 drivers/base/core.c:2783 uevent_show+0x1a0/0x310 drivers/base/core.c:2830 dev_attr_show+0x58/0xc0 drivers/base/core.c:2491 sysfs_kf_seq_show+0x331/0x490 fs/sysfs/file.c:65 seq_read_iter+0x463/0xca0 fs/seq_file.c:231 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x595/0xa80 fs/read_write.c:574 ksys_read+0x150/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd992ea7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffe6795ba80 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd993694880 RCX: 00007fd992ea7407 RDX: 0000000000001000 RSI: 000055ffb2af1300 RDI: 000000000000000c RBP: 00007fd992fefff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007fd992fefea0 R14: 0000000000000000 R15: 000055ffb2ade8a0 Allocated by task 5850: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5850: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x1c5/0x650 mm/slub.c:6792 redrat3_delete drivers/media/rc/redrat3.c:466 [inline] redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888023755000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1880 bytes inside of freed 2048-byte region [ffff888023755000, ffff888023755800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888023750000 pfn:0x23750 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000240 ffff88801b042000 ffffea0000d37410 ffffea0001dde610 raw: ffff888023750000 0000000000080005 00000000f5000000 0000000000000000 head: 00fff00000000240 ffff88801b042000 ffffea0000d37410 ffffea0001dde610 head: ffff888023750000 0000000000080005 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5762, tgid 5762 (syz-executor), ts 104571741824 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545 kmalloc_reserve net/core/skbuff.c:637 [inline] pskb_expand_head+0x22c/0x13a0 net/core/skbuff.c:2315 netlink_trim+0x1b3/0x2c0 net/netlink/af_netlink.c:1300 netlink_broadcast_filtered+0x6d/0xea0 net/netlink/af_netlink.c:1518 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline] nlmsg_multicast include/net/netlink.h:1184 [inline] nlmsg_notify+0xe3/0x1a0 net/netlink/af_netlink.c:2599 __dev_notify_flags+0x257/0x510 net/core/dev.c:9849 rtnl_configure_link+0x2f5/0x510 net/core/rtnetlink.c:3732 veth_newlink+0x553/0xdd0 drivers/net/veth.c:1880 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969 __rtnl_newlink net/core/rtnetlink.c:4098 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215 page last free pid 5449 tgid 5449 ts 65960944953 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 __slab_free+0x274/0x2c0 mm/slub.c:5815 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x29f/0x600 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] tomoyo_init_log+0x112e/0x1fa0 security/tomoyo/audit.c:262 tomoyo_supervisor+0x35f/0x1560 security/tomoyo/common.c:2232 tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline] tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64 tomoyo_environ security/tomoyo/domain.c:673 [inline] tomoyo_find_next_domain+0x1332/0x1a90 security/tomoyo/domain.c:889 tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102 security_bprm_check+0x85/0x240 security/security.c:820 search_binary_handler fs/exec.c:1755 [inline] exec_binprm fs/exec.c:1797 [inline] bprm_execve+0x888/0x1590 fs/exec.c:1853 do_execveat_common+0x4f4/0x670 fs/exec.c:1951 __do_sys_execve fs/exec.c:2024 [inline] __se_sys_execve fs/exec.c:2018 [inline] __x64_sys_execve+0x97/0xc0 fs/exec.c:2018 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 Memory state around the buggy address: ffff888023755600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023755680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888023755700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888023755780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023755800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================