Extracting prog: 3h0m46.906332266s
Minimizing prog: 27m46.522555844s
Simplifying prog options: 6m36.780297613s
Extracting C: 1m52.9756854s
Simplifying C: 0s


extracting reproducer from 23 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close-openat-mkdirat-mkdirat-mkdirat-symlinkat-openat-write-write-close-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 23 programs with base timeout 30s
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 12, 30, 14, 16, 23, 1, 12, 4, 8, 14, 30, 23, 5, 8, 5, 19, 25, 26, 7, 20]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x5f5e100})
ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20)
r1 = socket$phonet(0x23, 0x2, 0x1)
bind$phonet(r1, &(0x7f0000000080)={0x23, 0x2, 0x8}, 0x10)
r2 = socket$phonet_pipe(0x23, 0x805, 0x2)
bind$phonet(r2, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10)
connect$phonet_pipe(r2, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@getaddr={0x0, 0x16, 0x1}, 0x14}}, 0x0)
sendto$phonet(r1, &(0x7f0000000300)="0041010000000000", 0x8, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0x4008aea2, 0x200000)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x10000, &(0x7f0000000000/0x10000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d04, 0x0, 0x1}]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0xf, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0x4, 0x80, 0x2, 0x4, 0x0, 0x7, 0x80000001, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x1000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="23000000010000000500010008000000"]}, 0x20}], 0x1}, 0x0)
r1 = socket$phonet_pipe(0x23, 0x5, 0x2)
bind$phonet(r1, &(0x7f0000000200)={0x23, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'veth0\x00', 0x1})
r2 = socket$phonet(0x23, 0x2, 0x1)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="2300000001000000050001000c000000"]}, 0x20}], 0x1}, 0x0)
bind$phonet(r2, &(0x7f0000000600)={0x23, 0xc}, 0x10)
sendto$phonet(r2, &(0x7f0000000700)="0061010103040000", 0x8, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
sendto$phonet(r2, &(0x7f0000000900)="00640100", 0x4, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 0:
syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001010200010902200001010080320904000002ff0000000705810240000007050202400000"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/gspca_stv06xx/parameters/dump_bridge\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='y', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/STV06xx/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='5-1:1.0', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/drivers/STV06xx/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000280)='5-1:1.0', 0x7)
close(r2)
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002000000406d0450080001000000010902120001010080fa0904000000ffffff00"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='mem\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xc)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902270001010080320904000003ff000000070581020002000705020200020007058303400001"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x802, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0)
close(r1)
syz_usb_disconnect(r0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async)
socket$pppoe(0x18, 0x1, 0x0) (async, rerun: 32)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0) (async)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (rerun: 32)
r2 = socket(0x10, 0x803, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, 0x0) (async)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x22}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000)
executing program 2:
prlimit64(0x0, 0x5, &(0x7f0000000600)={0x27b6, 0x20000008b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000000)=0x6) (async, rerun: 64)
prlimit64(r0, 0xa, 0x0, 0x0) (rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
mremap(&(0x7f000015e000/0x4000)=nil, 0x4000, 0x800000, 0x2, &(0x7f0000130000/0x800000)=nil) (async, rerun: 64)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x7}, 0x1c)
setsockopt$inet6_int(r5, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) (async)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async, rerun: 32)
bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) (rerun: 32)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async, rerun: 32)
sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRESOCT, @ANYRES64=r3, @ANYBLOB="0c009900ffffffff17000000"], 0x28}, 0x1, 0x0, 0x0, 0x48041}, 0x4044) (async, rerun: 32)
sched_setscheduler(0x0, 0x1, 0x0) (async, rerun: 32)
socket$inet(0x2, 0x1, 0x0) (rerun: 32)
socket$nl_route(0x10, 0x3, 0x0) (async)
syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000840)={[{@acl}, {@user_xattr}, {@grpjquota_path}, {@sysvgroups}, {@init_itable}, {@min_batch_time={'min_batch_time', 0x3d, 0x10}}, {@auto_da_alloc}, {@noload}, {@nodiscard}, {@nodelalloc}, {@data_err_abort}]}, 0xff, 0x4a8, &(0x7f0000000240)="$eJzs3M9rHFUcAPDvbDbp7yZWrba2NlqF4o+kSVvtQRB/QQ8KBT3UY0zSUps20kSwJdjooR6lIF7Fo+Bf4MmTqCfBaz0KUigahFYRXJndmc1mu5tummw2Jp8PbDJv3sx77zszb/J23mYD2LD60x9JxPaIuB4RvZXkwg36K79uz82M/jU3M5pEqfTm70l5u1tzM6OlTL7ftqzMHQsqie7aYqcuXT43MjExfjFLD06ff29w6tLlZ8+eHzkzfmb8wqYsY/hYg1b/em3xqP65Y00a3629H07u23Pi7WtvjPZce+eHr9P27t5fyU/juNuxWqr+NPA/KsemPu/Jla6sw/4tzceZFDvdGlrVFRHFrHNej97oivmT1xuvfdzRxgFtld6zNzXPni0B61gSnW4B0Bn5H/r0/W/+WqWhx5pw86XKG6A07tvZq5JTjEK2TXcb6++PiFOzf39xarZSW+3xLzV4bgAAsFzfpuOfZxqN/wqxu2a7ndncUF9E3BcRuyLi/oh4ICIejChv+1BEPLzE+vvr0neOPws37imwFqXjvxeyua2F47989Bd9XVlqRzn+7uT02Ynxw9kxORTdm9L0UKPC8yJe/fnTZvXPj/8qr7T+9HdNITeKlQd0m/M1YyPTIys1KL35UcTeYqP4k+pMQBIReyJi79KK3pkvnH3qq33NNmoY/+ctBrcC80ylL/NCZmajLv5c0mh+cvj48aNHhp5/bvjY4OaYGD88mF8V+eOUK9X9f/zp6slm9d/9/LdXev63Lrz+67bo/TOpna+dqma82GodV3/5pP49ZbVzFVu//qvS678neas8p9uTrftgZHr64lBET/J6Ob1g/fD8vnk63z6N/9DBxv1/V7ZPGv8jEZFexPsj4tGIOJCdu8ci4vGIOLhI/N+//MS7zfLWwvkfa3j/q17/fQvPf/OFniZZXee++6ZZ/a3d/46Wlw5la8r3v7to3tL8Nlp3NQMAAMA6Vih/Nj4pDFSWqx/Z31Z+tru1MDE5Nf306cn3L4xVPkPfF92F/ElXb83z0KFkNtuzkh7OnhXn+Uey58afdW0ppwdGJyfGOhc2kPXzmv4f26NQGBio5P3W1enWAW3n/7Vg46rv/4UOtQNYff7+w8al/8PGpf/DxtWo/1+pS5sLgPWo1NvpFgCd0+L4/5V2twNYfd7/w8a1WP9v55dfAR3Vyv/1L2FhS1bsssopLm/3/8dCeqRWpa6+NpUchY4fwzW1cGDFetPJQsTyyineY+8+MTe/5s57xSLfEw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBm/RcAAP//9N/01g==")
executing program 2:
r0 = socket$kcm(0x11, 0x2, 0x300)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x70bd2d, 0x259fdbfd, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080)
syz_open_dev$usbmon(0x0, 0x1, 0x8a80)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r6 = getpgrp(0x0)
sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r7 = getpid()
sched_setscheduler(r7, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r8 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x1, 0x0)
r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async)
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x108a, 0x0, 0x0, 0x2000020, 0x6}}) (async)
sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x50)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x39b3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48)
ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af839)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20)
recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)=""/83, 0x53}], 0x1}, 0x81}], 0x2, 0x21, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x210006, &(0x7f0000000000), 0x1, 0x56e, &(0x7f0000000e40)="$eJzs3U9vHGcZAPBn1uvEblycAodSqSWCoqSiWcc1bS0ObSMQtwpQuAfL2ViW197gXTexVVWuOHBE4kArceLEBYkPgIT6EVClSvSOAIEqSMoBIcqgmZ1t7M2sa5Ndr+P9/aTxvvPOn+d5d73jd/54JoCxdSEiXouIiYh4LiJmi/pKMcRuZ8jmu3f3zeVsiEji2t+TSIq6iLz4qXPFYlOdl1Kt7Z21pUajvlmMz7XXb821tncur64vrdRX6hsLC/MvLb68+OLilbLFV47azqxdr3z7Lz//6a++88rvnr/9x+t/u/RWlvS3iulFOwbuw/znZPZedP2oGhGbwwg2AtnvTTVvIQAAj4Ksj//5iPhK3v+fjYm8N5fr7dJNHX92AAAAwCCkr87Ef5KINO3u3qcAAADAKfNqRMxEUqkV1wLMRKVSq3Wu4f1iPFZpNFvtr99sbm3cyKblV3pWbq426leKa2rPx2SSjc/n5fvjL/SML0TEExHxcTqdj9eWm41/p2k64sMfAAAAMBbO9ez//3O3s/8PAAAAnDLnjzh/ZUh5AAAAAMNT7P9P9NYnI8gFAAAAGI6jnv8HAAAAHinfe/31bEi7z7++8cb21lrzjcs36q212vrWcm25uXmrttJsruT37Fv/rPU1ms1b34iNrTtz7XqrPdfa3rm+3tzaaF9f9fxAAAAAGJUnvvzeh0lE7H5zOh8yZ6LsnwEKrhWAU+NIt/L4876xs4POBThe/f7MA6dfddQJAKOze/RFLgwjD2Bk9t3qo6RTsPfinX3HDH4/vJwAAIDBuvilJMrO/+dP+h91csBQeZQHjC/n/2F8HfH8//vDygM4fpN6ADD2+j/qY7r/QtN9zv+fKZs5TbslNwIBAIDRmMmHpFIrzgXORKVSq0U8nv+r/2Ryc7VRvxIRn4uIP8xOns3G5/MlE48HBAAAAAAAAAAAAAAAAAAAAAAAAIBDStMk0v6qB00EAAAAHg0Rlb9GtfP8r4uzz870Hh84k/xrNopHet3+xbV37sxOtTfns/p/PN+tb7977Z07S+325gujOIIBAAAA9Orup+ev86POBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBT5ZPbEXffXL5XDMcZ+qOr8d04H3HvgfjVmMpfp2IyIh77OInqnuWSiJgYQPzdtyPiybL4SZZWnC+y6I1fiYjpwcefvD/l0/hPp2laxD+zL/65AcSHcfbe1Yh4rez7X4kLcTbf/kTJ979aDA/ro6v5l7w0fnf7N9Fn+/f4IWM89cFv5vrGfzviqWr59q8bP+kTv1K2wpI35Yc/2Nl5oLKz8kh/GXExyuPvjTXXXr8119reuby6vrRSX6lvLCzMv7T48uKLi1fmbq426sXP0jb+7Onf/ren6pO0I29/PBj/J9H5WA5s/7NZYc8WO9LeMEWwD+7c/cKD1XkDs/iXvlr++T95QPzsd+JrxWeQTb/YLe92yns98+v3nylNrIh/o8/7/1mf/6Wz/da633Pf//GfDjcnAHAcWts7a0uNRn3zUIXpo8y8vbOWphHdmnfTNC2bJ9unPfQK/8/C0Vs6foVu725oIaZOSktPQCHrW5+ANPoVBnFkCwAAOGnud/oPvchbQ00IAAAAAAAAAAAAAAAAAAAAxlBrOyoH3w8sTSMe7nZivTF3R9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD/S8AAP//pe/SIQ==")
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0x7e, 0x4, 0xffff})
r1 = syz_clone(0x22000, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$setsig(0x4203, r1, 0xffffffffffff04be, &(0x7f0000000ac0)={0x35, 0xec50, 0x5})
executing program 4:
recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffe3b}, 0x0) (async)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x34}}, 0x20002000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="0fc7284625c87dc07148b8b9000000000000000f23d00f21f835100000070f23f848b8bcc585fc2fd3c5080f23d00f21f835000000080f23f8660fc7b374000000450fc7720ec48189c6168bc744240060000000c744240200380000ff2c2466baf80cb808122188ef66bafc0ced66ba610066ed", 0x74}], 0x1, 0xb, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4)
sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000040)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x40440a4}, 0x20000018)
executing program 3:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000500)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000600)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000700)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000800)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000b00)='P\x00')
nanosleep(&(0x7f0000000c00)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000000d00), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000000e00), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000000f00), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001000), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001600)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001700)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001800)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000001900)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040341278560001010203010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xb, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000200)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000300))
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_udc.0\n\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x1d6b\n\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='0x0104\n\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0\n\x00', 0xc)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='dummy_udc.0\n\x00', 0xc)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/power/state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='mem\n\x00', 0x4)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close-openat-mkdirat-mkdirat-mkdirat-symlinkat-openat-write-write-close-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 23 programs with base timeout 1m40s
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 12, 30, 14, 16, 23, 1, 12, 4, 8, 14, 30, 23, 5, 8, 5, 19, 25, 26, 7, 20]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x5f5e100})
ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20)
r1 = socket$phonet(0x23, 0x2, 0x1)
bind$phonet(r1, &(0x7f0000000080)={0x23, 0x2, 0x8}, 0x10)
r2 = socket$phonet_pipe(0x23, 0x805, 0x2)
bind$phonet(r2, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10)
connect$phonet_pipe(r2, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@getaddr={0x0, 0x16, 0x1}, 0x14}}, 0x0)
sendto$phonet(r1, &(0x7f0000000300)="0041010000000000", 0x8, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0x4008aea2, 0x200000)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x10000, &(0x7f0000000000/0x10000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d04, 0x0, 0x1}]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0xf, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0x4, 0x80, 0x2, 0x4, 0x0, 0x7, 0x80000001, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x1000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="23000000010000000500010008000000"]}, 0x20}], 0x1}, 0x0)
r1 = socket$phonet_pipe(0x23, 0x5, 0x2)
bind$phonet(r1, &(0x7f0000000200)={0x23, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'veth0\x00', 0x1})
r2 = socket$phonet(0x23, 0x2, 0x1)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="2300000001000000050001000c000000"]}, 0x20}], 0x1}, 0x0)
bind$phonet(r2, &(0x7f0000000600)={0x23, 0xc}, 0x10)
sendto$phonet(r2, &(0x7f0000000700)="0061010103040000", 0x8, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
sendto$phonet(r2, &(0x7f0000000900)="00640100", 0x4, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 0:
syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001010200010902200001010080320904000002ff0000000705810240000007050202400000"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/gspca_stv06xx/parameters/dump_bridge\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='y', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/STV06xx/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='5-1:1.0', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/drivers/STV06xx/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000280)='5-1:1.0', 0x7)
close(r2)
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002000000406d0450080001000000010902120001010080fa0904000000ffffff00"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='mem\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xc)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902270001010080320904000003ff000000070581020002000705020200020007058303400001"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x802, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0)
close(r1)
syz_usb_disconnect(r0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async)
socket$pppoe(0x18, 0x1, 0x0) (async, rerun: 32)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0) (async)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (rerun: 32)
r2 = socket(0x10, 0x803, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, 0x0) (async)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x22}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000)
executing program 2:
prlimit64(0x0, 0x5, &(0x7f0000000600)={0x27b6, 0x20000008b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000000)=0x6) (async, rerun: 64)
prlimit64(r0, 0xa, 0x0, 0x0) (rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
mremap(&(0x7f000015e000/0x4000)=nil, 0x4000, 0x800000, 0x2, &(0x7f0000130000/0x800000)=nil) (async, rerun: 64)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x7}, 0x1c)
setsockopt$inet6_int(r5, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) (async)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async, rerun: 32)
bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) (rerun: 32)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async, rerun: 32)
sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRESOCT, @ANYRES64=r3, @ANYBLOB="0c009900ffffffff17000000"], 0x28}, 0x1, 0x0, 0x0, 0x48041}, 0x4044) (async, rerun: 32)
sched_setscheduler(0x0, 0x1, 0x0) (async, rerun: 32)
socket$inet(0x2, 0x1, 0x0) (rerun: 32)
socket$nl_route(0x10, 0x3, 0x0) (async)
syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000840)={[{@acl}, {@user_xattr}, {@grpjquota_path}, {@sysvgroups}, {@init_itable}, {@min_batch_time={'min_batch_time', 0x3d, 0x10}}, {@auto_da_alloc}, {@noload}, {@nodiscard}, {@nodelalloc}, {@data_err_abort}]}, 0xff, 0x4a8, &(0x7f0000000240)="$eJzs3M9rHFUcAPDvbDbp7yZWrba2NlqF4o+kSVvtQRB/QQ8KBT3UY0zSUps20kSwJdjooR6lIF7Fo+Bf4MmTqCfBaz0KUigahFYRXJndmc1mu5tummw2Jp8PbDJv3sx77zszb/J23mYD2LD60x9JxPaIuB4RvZXkwg36K79uz82M/jU3M5pEqfTm70l5u1tzM6OlTL7ftqzMHQsqie7aYqcuXT43MjExfjFLD06ff29w6tLlZ8+eHzkzfmb8wqYsY/hYg1b/em3xqP65Y00a3629H07u23Pi7WtvjPZce+eHr9P27t5fyU/juNuxWqr+NPA/KsemPu/Jla6sw/4tzceZFDvdGlrVFRHFrHNej97oivmT1xuvfdzRxgFtld6zNzXPni0B61gSnW4B0Bn5H/r0/W/+WqWhx5pw86XKG6A07tvZq5JTjEK2TXcb6++PiFOzf39xarZSW+3xLzV4bgAAsFzfpuOfZxqN/wqxu2a7ndncUF9E3BcRuyLi/oh4ICIejChv+1BEPLzE+vvr0neOPws37imwFqXjvxeyua2F47989Bd9XVlqRzn+7uT02Ynxw9kxORTdm9L0UKPC8yJe/fnTZvXPj/8qr7T+9HdNITeKlQd0m/M1YyPTIys1KL35UcTeYqP4k+pMQBIReyJi79KK3pkvnH3qq33NNmoY/+ctBrcC80ylL/NCZmajLv5c0mh+cvj48aNHhp5/bvjY4OaYGD88mF8V+eOUK9X9f/zp6slm9d/9/LdXev63Lrz+67bo/TOpna+dqma82GodV3/5pP49ZbVzFVu//qvS678neas8p9uTrftgZHr64lBET/J6Ob1g/fD8vnk63z6N/9DBxv1/V7ZPGv8jEZFexPsj4tGIOJCdu8ci4vGIOLhI/N+//MS7zfLWwvkfa3j/q17/fQvPf/OFniZZXee++6ZZ/a3d/46Wlw5la8r3v7to3tL8Nlp3NQMAAMA6Vih/Nj4pDFSWqx/Z31Z+tru1MDE5Nf306cn3L4xVPkPfF92F/ElXb83z0KFkNtuzkh7OnhXn+Uey58afdW0ppwdGJyfGOhc2kPXzmv4f26NQGBio5P3W1enWAW3n/7Vg46rv/4UOtQNYff7+w8al/8PGpf/DxtWo/1+pS5sLgPWo1NvpFgCd0+L4/5V2twNYfd7/w8a1WP9v55dfAR3Vyv/1L2FhS1bsssopLm/3/8dCeqRWpa6+NpUchY4fwzW1cGDFetPJQsTyyineY+8+MTe/5s57xSLfEw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBm/RcAAP//9N/01g==")
executing program 2:
r0 = socket$kcm(0x11, 0x2, 0x300)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x70bd2d, 0x259fdbfd, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080)
syz_open_dev$usbmon(0x0, 0x1, 0x8a80)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r6 = getpgrp(0x0)
sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r7 = getpid()
sched_setscheduler(r7, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r8 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x1, 0x0)
r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async)
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x108a, 0x0, 0x0, 0x2000020, 0x6}}) (async)
sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x50)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x39b3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48)
ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af839)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20)
recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)=""/83, 0x53}], 0x1}, 0x81}], 0x2, 0x21, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x210006, &(0x7f0000000000), 0x1, 0x56e, &(0x7f0000000e40)="$eJzs3U9vHGcZAPBn1uvEblycAodSqSWCoqSiWcc1bS0ObSMQtwpQuAfL2ViW197gXTexVVWuOHBE4kArceLEBYkPgIT6EVClSvSOAIEqSMoBIcqgmZ1t7M2sa5Ndr+P9/aTxvvPOn+d5d73jd/54JoCxdSEiXouIiYh4LiJmi/pKMcRuZ8jmu3f3zeVsiEji2t+TSIq6iLz4qXPFYlOdl1Kt7Z21pUajvlmMz7XXb821tncur64vrdRX6hsLC/MvLb68+OLilbLFV47azqxdr3z7Lz//6a++88rvnr/9x+t/u/RWlvS3iulFOwbuw/znZPZedP2oGhGbwwg2AtnvTTVvIQAAj4Ksj//5iPhK3v+fjYm8N5fr7dJNHX92AAAAwCCkr87Ef5KINO3u3qcAAADAKfNqRMxEUqkV1wLMRKVSq3Wu4f1iPFZpNFvtr99sbm3cyKblV3pWbq426leKa2rPx2SSjc/n5fvjL/SML0TEExHxcTqdj9eWm41/p2k64sMfAAAAMBbO9ez//3O3s/8PAAAAnDLnjzh/ZUh5AAAAAMNT7P9P9NYnI8gFAAAAGI6jnv8HAAAAHinfe/31bEi7z7++8cb21lrzjcs36q212vrWcm25uXmrttJsruT37Fv/rPU1ms1b34iNrTtz7XqrPdfa3rm+3tzaaF9f9fxAAAAAGJUnvvzeh0lE7H5zOh8yZ6LsnwEKrhWAU+NIt/L4876xs4POBThe/f7MA6dfddQJAKOze/RFLgwjD2Bk9t3qo6RTsPfinX3HDH4/vJwAAIDBuvilJMrO/+dP+h91csBQeZQHjC/n/2F8HfH8//vDygM4fpN6ADD2+j/qY7r/QtN9zv+fKZs5TbslNwIBAIDRmMmHpFIrzgXORKVSq0U8nv+r/2Ryc7VRvxIRn4uIP8xOns3G5/MlE48HBAAAAAAAAAAAAAAAAAAAAAAAAIBDStMk0v6qB00EAAAAHg0Rlb9GtfP8r4uzz870Hh84k/xrNopHet3+xbV37sxOtTfns/p/PN+tb7977Z07S+325gujOIIBAAAA9Orup+ev86POBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBT5ZPbEXffXL5XDMcZ+qOr8d04H3HvgfjVmMpfp2IyIh77OInqnuWSiJgYQPzdtyPiybL4SZZWnC+y6I1fiYjpwcefvD/l0/hPp2laxD+zL/65AcSHcfbe1Yh4rez7X4kLcTbf/kTJ979aDA/ro6v5l7w0fnf7N9Fn+/f4IWM89cFv5vrGfzviqWr59q8bP+kTv1K2wpI35Yc/2Nl5oLKz8kh/GXExyuPvjTXXXr8119reuby6vrRSX6lvLCzMv7T48uKLi1fmbq426sXP0jb+7Onf/ren6pO0I29/PBj/J9H5WA5s/7NZYc8WO9LeMEWwD+7c/cKD1XkDs/iXvlr++T95QPzsd+JrxWeQTb/YLe92yns98+v3nylNrIh/o8/7/1mf/6Wz/da633Pf//GfDjcnAHAcWts7a0uNRn3zUIXpo8y8vbOWphHdmnfTNC2bJ9unPfQK/8/C0Vs6foVu725oIaZOSktPQCHrW5+ANPoVBnFkCwAAOGnud/oPvchbQ00IAAAAAAAAAAAAAAAAAAAAxlBrOyoH3w8sTSMe7nZivTF3R9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD/S8AAP//pe/SIQ==")
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0x7e, 0x4, 0xffff})
r1 = syz_clone(0x22000, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$setsig(0x4203, r1, 0xffffffffffff04be, &(0x7f0000000ac0)={0x35, 0xec50, 0x5})
executing program 4:
recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffe3b}, 0x0) (async)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x34}}, 0x20002000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="0fc7284625c87dc07148b8b9000000000000000f23d00f21f835100000070f23f848b8bcc585fc2fd3c5080f23d00f21f835000000080f23f8660fc7b374000000450fc7720ec48189c6168bc744240060000000c744240200380000ff2c2466baf80cb808122188ef66bafc0ced66ba610066ed", 0x74}], 0x1, 0xb, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4)
sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000040)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x40440a4}, 0x20000018)
executing program 3:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000500)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000600)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000700)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000800)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000b00)='P\x00')
nanosleep(&(0x7f0000000c00)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000000d00), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000000e00), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000000f00), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001000), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001600)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001700)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001800)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000001900)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040341278560001010203010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xb, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000200)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000300))
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_udc.0\n\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x1d6b\n\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='0x0104\n\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0\n\x00', 0xc)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='dummy_udc.0\n\x00', 0xc)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/power/state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='mem\n\x00', 0x4)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close-openat-mkdirat-mkdirat-mkdirat-symlinkat-openat-write-write-close-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
single: failed to extract reproducer
bisect: bisecting 23 programs with base timeout 6m0s
testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 12, 30, 14, 16, 23, 1, 12, 4, 8, 14, 30, 23, 5, 8, 5, 19, 25, 26, 7, 20]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x5f5e100})
ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20)
r1 = socket$phonet(0x23, 0x2, 0x1)
bind$phonet(r1, &(0x7f0000000080)={0x23, 0x2, 0x8}, 0x10)
r2 = socket$phonet_pipe(0x23, 0x805, 0x2)
bind$phonet(r2, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10)
connect$phonet_pipe(r2, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@getaddr={0x0, 0x16, 0x1}, 0x14}}, 0x0)
sendto$phonet(r1, &(0x7f0000000300)="0041010000000000", 0x8, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0x4008aea2, 0x200000)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x10000, &(0x7f0000000000/0x10000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d04, 0x0, 0x1}]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0xf, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0x4, 0x80, 0x2, 0x4, 0x0, 0x7, 0x80000001, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x1000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="23000000010000000500010008000000"]}, 0x20}], 0x1}, 0x0)
r1 = socket$phonet_pipe(0x23, 0x5, 0x2)
bind$phonet(r1, &(0x7f0000000200)={0x23, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'veth0\x00', 0x1})
r2 = socket$phonet(0x23, 0x2, 0x1)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="2300000001000000050001000c000000"]}, 0x20}], 0x1}, 0x0)
bind$phonet(r2, &(0x7f0000000600)={0x23, 0xc}, 0x10)
sendto$phonet(r2, &(0x7f0000000700)="0061010103040000", 0x8, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
sendto$phonet(r2, &(0x7f0000000900)="00640100", 0x4, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 0:
syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001010200010902200001010080320904000002ff0000000705810240000007050202400000"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/gspca_stv06xx/parameters/dump_bridge\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='y', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/STV06xx/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='5-1:1.0', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/drivers/STV06xx/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000280)='5-1:1.0', 0x7)
close(r2)
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002000000406d0450080001000000010902120001010080fa0904000000ffffff00"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='mem\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xc)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902270001010080320904000003ff000000070581020002000705020200020007058303400001"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x802, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0)
close(r1)
syz_usb_disconnect(r0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async)
socket$pppoe(0x18, 0x1, 0x0) (async, rerun: 32)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0) (async)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (rerun: 32)
r2 = socket(0x10, 0x803, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, 0x0) (async)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x22}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000)
executing program 2:
prlimit64(0x0, 0x5, &(0x7f0000000600)={0x27b6, 0x20000008b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000000)=0x6) (async, rerun: 64)
prlimit64(r0, 0xa, 0x0, 0x0) (rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
mremap(&(0x7f000015e000/0x4000)=nil, 0x4000, 0x800000, 0x2, &(0x7f0000130000/0x800000)=nil) (async, rerun: 64)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x7}, 0x1c)
setsockopt$inet6_int(r5, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) (async)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async, rerun: 32)
bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) (rerun: 32)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async, rerun: 32)
sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRESOCT, @ANYRES64=r3, @ANYBLOB="0c009900ffffffff17000000"], 0x28}, 0x1, 0x0, 0x0, 0x48041}, 0x4044) (async, rerun: 32)
sched_setscheduler(0x0, 0x1, 0x0) (async, rerun: 32)
socket$inet(0x2, 0x1, 0x0) (rerun: 32)
socket$nl_route(0x10, 0x3, 0x0) (async)
syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000840)={[{@acl}, {@user_xattr}, {@grpjquota_path}, {@sysvgroups}, {@init_itable}, {@min_batch_time={'min_batch_time', 0x3d, 0x10}}, {@auto_da_alloc}, {@noload}, {@nodiscard}, {@nodelalloc}, {@data_err_abort}]}, 0xff, 0x4a8, &(0x7f0000000240)="$eJzs3M9rHFUcAPDvbDbp7yZWrba2NlqF4o+kSVvtQRB/QQ8KBT3UY0zSUps20kSwJdjooR6lIF7Fo+Bf4MmTqCfBaz0KUigahFYRXJndmc1mu5tummw2Jp8PbDJv3sx77zszb/J23mYD2LD60x9JxPaIuB4RvZXkwg36K79uz82M/jU3M5pEqfTm70l5u1tzM6OlTL7ftqzMHQsqie7aYqcuXT43MjExfjFLD06ff29w6tLlZ8+eHzkzfmb8wqYsY/hYg1b/em3xqP65Y00a3629H07u23Pi7WtvjPZce+eHr9P27t5fyU/juNuxWqr+NPA/KsemPu/Jla6sw/4tzceZFDvdGlrVFRHFrHNej97oivmT1xuvfdzRxgFtld6zNzXPni0B61gSnW4B0Bn5H/r0/W/+WqWhx5pw86XKG6A07tvZq5JTjEK2TXcb6++PiFOzf39xarZSW+3xLzV4bgAAsFzfpuOfZxqN/wqxu2a7ndncUF9E3BcRuyLi/oh4ICIejChv+1BEPLzE+vvr0neOPws37imwFqXjvxeyua2F47989Bd9XVlqRzn+7uT02Ynxw9kxORTdm9L0UKPC8yJe/fnTZvXPj/8qr7T+9HdNITeKlQd0m/M1YyPTIys1KL35UcTeYqP4k+pMQBIReyJi79KK3pkvnH3qq33NNmoY/+ctBrcC80ylL/NCZmajLv5c0mh+cvj48aNHhp5/bvjY4OaYGD88mF8V+eOUK9X9f/zp6slm9d/9/LdXev63Lrz+67bo/TOpna+dqma82GodV3/5pP49ZbVzFVu//qvS678neas8p9uTrftgZHr64lBET/J6Ob1g/fD8vnk63z6N/9DBxv1/V7ZPGv8jEZFexPsj4tGIOJCdu8ci4vGIOLhI/N+//MS7zfLWwvkfa3j/q17/fQvPf/OFniZZXee++6ZZ/a3d/46Wlw5la8r3v7to3tL8Nlp3NQMAAMA6Vih/Nj4pDFSWqx/Z31Z+tru1MDE5Nf306cn3L4xVPkPfF92F/ElXb83z0KFkNtuzkh7OnhXn+Uey58afdW0ppwdGJyfGOhc2kPXzmv4f26NQGBio5P3W1enWAW3n/7Vg46rv/4UOtQNYff7+w8al/8PGpf/DxtWo/1+pS5sLgPWo1NvpFgCd0+L4/5V2twNYfd7/w8a1WP9v55dfAR3Vyv/1L2FhS1bsssopLm/3/8dCeqRWpa6+NpUchY4fwzW1cGDFetPJQsTyyineY+8+MTe/5s57xSLfEw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBm/RcAAP//9N/01g==")
executing program 2:
r0 = socket$kcm(0x11, 0x2, 0x300)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x70bd2d, 0x259fdbfd, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080)
syz_open_dev$usbmon(0x0, 0x1, 0x8a80)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r6 = getpgrp(0x0)
sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r7 = getpid()
sched_setscheduler(r7, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r8 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x1, 0x0)
r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async)
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x108a, 0x0, 0x0, 0x2000020, 0x6}}) (async)
sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x50)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x39b3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48)
ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af839)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20)
recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)=""/83, 0x53}], 0x1}, 0x81}], 0x2, 0x21, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x210006, &(0x7f0000000000), 0x1, 0x56e, &(0x7f0000000e40)="$eJzs3U9vHGcZAPBn1uvEblycAodSqSWCoqSiWcc1bS0ObSMQtwpQuAfL2ViW197gXTexVVWuOHBE4kArceLEBYkPgIT6EVClSvSOAIEqSMoBIcqgmZ1t7M2sa5Ndr+P9/aTxvvPOn+d5d73jd/54JoCxdSEiXouIiYh4LiJmi/pKMcRuZ8jmu3f3zeVsiEji2t+TSIq6iLz4qXPFYlOdl1Kt7Z21pUajvlmMz7XXb821tncur64vrdRX6hsLC/MvLb68+OLilbLFV47azqxdr3z7Lz//6a++88rvnr/9x+t/u/RWlvS3iulFOwbuw/znZPZedP2oGhGbwwg2AtnvTTVvIQAAj4Ksj//5iPhK3v+fjYm8N5fr7dJNHX92AAAAwCCkr87Ef5KINO3u3qcAAADAKfNqRMxEUqkV1wLMRKVSq3Wu4f1iPFZpNFvtr99sbm3cyKblV3pWbq426leKa2rPx2SSjc/n5fvjL/SML0TEExHxcTqdj9eWm41/p2k64sMfAAAAMBbO9ez//3O3s/8PAAAAnDLnjzh/ZUh5AAAAAMNT7P9P9NYnI8gFAAAAGI6jnv8HAAAAHinfe/31bEi7z7++8cb21lrzjcs36q212vrWcm25uXmrttJsruT37Fv/rPU1ms1b34iNrTtz7XqrPdfa3rm+3tzaaF9f9fxAAAAAGJUnvvzeh0lE7H5zOh8yZ6LsnwEKrhWAU+NIt/L4876xs4POBThe/f7MA6dfddQJAKOze/RFLgwjD2Bk9t3qo6RTsPfinX3HDH4/vJwAAIDBuvilJMrO/+dP+h91csBQeZQHjC/n/2F8HfH8//vDygM4fpN6ADD2+j/qY7r/QtN9zv+fKZs5TbslNwIBAIDRmMmHpFIrzgXORKVSq0U8nv+r/2Ryc7VRvxIRn4uIP8xOns3G5/MlE48HBAAAAAAAAAAAAAAAAAAAAAAAAIBDStMk0v6qB00EAAAAHg0Rlb9GtfP8r4uzz870Hh84k/xrNopHet3+xbV37sxOtTfns/p/PN+tb7977Z07S+325gujOIIBAAAA9Orup+ev86POBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBT5ZPbEXffXL5XDMcZ+qOr8d04H3HvgfjVmMpfp2IyIh77OInqnuWSiJgYQPzdtyPiybL4SZZWnC+y6I1fiYjpwcefvD/l0/hPp2laxD+zL/65AcSHcfbe1Yh4rez7X4kLcTbf/kTJ979aDA/ro6v5l7w0fnf7N9Fn+/f4IWM89cFv5vrGfzviqWr59q8bP+kTv1K2wpI35Yc/2Nl5oLKz8kh/GXExyuPvjTXXXr8119reuby6vrRSX6lvLCzMv7T48uKLi1fmbq426sXP0jb+7Onf/ren6pO0I29/PBj/J9H5WA5s/7NZYc8WO9LeMEWwD+7c/cKD1XkDs/iXvlr++T95QPzsd+JrxWeQTb/YLe92yns98+v3nylNrIh/o8/7/1mf/6Wz/da633Pf//GfDjcnAHAcWts7a0uNRn3zUIXpo8y8vbOWphHdmnfTNC2bJ9unPfQK/8/C0Vs6foVu725oIaZOSktPQCHrW5+ANPoVBnFkCwAAOGnud/oPvchbQ00IAAAAAAAAAAAAAAAAAAAAxlBrOyoH3w8sTSMe7nZivTF3R9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD/S8AAP//pe/SIQ==")
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0x7e, 0x4, 0xffff})
r1 = syz_clone(0x22000, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$setsig(0x4203, r1, 0xffffffffffff04be, &(0x7f0000000ac0)={0x35, 0xec50, 0x5})
executing program 4:
recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffe3b}, 0x0) (async)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x34}}, 0x20002000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="0fc7284625c87dc07148b8b9000000000000000f23d00f21f835100000070f23f848b8bcc585fc2fd3c5080f23d00f21f835000000080f23f8660fc7b374000000450fc7720ec48189c6168bc744240060000000c744240200380000ff2c2466baf80cb808122188ef66bafc0ced66ba610066ed", 0x74}], 0x1, 0xb, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4)
sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000040)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x40440a4}, 0x20000018)
executing program 3:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000500)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000600)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000700)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000800)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000b00)='P\x00')
nanosleep(&(0x7f0000000c00)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000000d00), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000000e00), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000000f00), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001000), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001600)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001700)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001800)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000001900)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040341278560001010203010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xb, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000200)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000300))
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_udc.0\n\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x1d6b\n\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='0x0104\n\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0\n\x00', 0xc)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='dummy_udc.0\n\x00', 0xc)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/power/state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='mem\n\x00', 0x4)

program crashed: general protection fault in set_link_state
bisect: bisecting 23 programs
bisect: split chunks (needed=false): <22>
bisect: split chunk #0 of len 22 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 12, 4, 8, 14, 30, 23, 5, 8, 5, 19, 25, 26, 7, 20]
detailed listing:
executing program 0:
syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001010200010902200001010080320904000002ff0000000705810240000007050202400000"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/gspca_stv06xx/parameters/dump_bridge\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='y', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/STV06xx/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='5-1:1.0', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/drivers/STV06xx/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000280)='5-1:1.0', 0x7)
close(r2)
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002000000406d0450080001000000010902120001010080fa0904000000ffffff00"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='mem\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xc)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902270001010080320904000003ff000000070581020002000705020200020007058303400001"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x802, 0x0) (async)
syz_usb_control_io(r0, 0x0, 0x0)
close(r1)
syz_usb_disconnect(r0)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async)
socket$pppoe(0x18, 0x1, 0x0) (async, rerun: 32)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0) (async)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (rerun: 32)
r2 = socket(0x10, 0x803, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, 0x0) (async)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x22}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000)
executing program 2:
prlimit64(0x0, 0x5, &(0x7f0000000600)={0x27b6, 0x20000008b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000000)=0x6) (async, rerun: 64)
prlimit64(r0, 0xa, 0x0, 0x0) (rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
mremap(&(0x7f000015e000/0x4000)=nil, 0x4000, 0x800000, 0x2, &(0x7f0000130000/0x800000)=nil) (async, rerun: 64)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x7}, 0x1c)
setsockopt$inet6_int(r5, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) (async)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async, rerun: 32)
bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) (rerun: 32)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async, rerun: 32)
sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRESOCT, @ANYRES64=r3, @ANYBLOB="0c009900ffffffff17000000"], 0x28}, 0x1, 0x0, 0x0, 0x48041}, 0x4044) (async, rerun: 32)
sched_setscheduler(0x0, 0x1, 0x0) (async, rerun: 32)
socket$inet(0x2, 0x1, 0x0) (rerun: 32)
socket$nl_route(0x10, 0x3, 0x0) (async)
syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000840)={[{@acl}, {@user_xattr}, {@grpjquota_path}, {@sysvgroups}, {@init_itable}, {@min_batch_time={'min_batch_time', 0x3d, 0x10}}, {@auto_da_alloc}, {@noload}, {@nodiscard}, {@nodelalloc}, {@data_err_abort}]}, 0xff, 0x4a8, &(0x7f0000000240)="$eJzs3M9rHFUcAPDvbDbp7yZWrba2NlqF4o+kSVvtQRB/QQ8KBT3UY0zSUps20kSwJdjooR6lIF7Fo+Bf4MmTqCfBaz0KUigahFYRXJndmc1mu5tummw2Jp8PbDJv3sx77zszb/J23mYD2LD60x9JxPaIuB4RvZXkwg36K79uz82M/jU3M5pEqfTm70l5u1tzM6OlTL7ftqzMHQsqie7aYqcuXT43MjExfjFLD06ff29w6tLlZ8+eHzkzfmb8wqYsY/hYg1b/em3xqP65Y00a3629H07u23Pi7WtvjPZce+eHr9P27t5fyU/juNuxWqr+NPA/KsemPu/Jla6sw/4tzceZFDvdGlrVFRHFrHNej97oivmT1xuvfdzRxgFtld6zNzXPni0B61gSnW4B0Bn5H/r0/W/+WqWhx5pw86XKG6A07tvZq5JTjEK2TXcb6++PiFOzf39xarZSW+3xLzV4bgAAsFzfpuOfZxqN/wqxu2a7ndncUF9E3BcRuyLi/oh4ICIejChv+1BEPLzE+vvr0neOPws37imwFqXjvxeyua2F47989Bd9XVlqRzn+7uT02Ynxw9kxORTdm9L0UKPC8yJe/fnTZvXPj/8qr7T+9HdNITeKlQd0m/M1YyPTIys1KL35UcTeYqP4k+pMQBIReyJi79KK3pkvnH3qq33NNmoY/+ctBrcC80ylL/NCZmajLv5c0mh+cvj48aNHhp5/bvjY4OaYGD88mF8V+eOUK9X9f/zp6slm9d/9/LdXev63Lrz+67bo/TOpna+dqma82GodV3/5pP49ZbVzFVu//qvS678neas8p9uTrftgZHr64lBET/J6Ob1g/fD8vnk63z6N/9DBxv1/V7ZPGv8jEZFexPsj4tGIOJCdu8ci4vGIOLhI/N+//MS7zfLWwvkfa3j/q17/fQvPf/OFniZZXee++6ZZ/a3d/46Wlw5la8r3v7to3tL8Nlp3NQMAAMA6Vih/Nj4pDFSWqx/Z31Z+tru1MDE5Nf306cn3L4xVPkPfF92F/ElXb83z0KFkNtuzkh7OnhXn+Uey58afdW0ppwdGJyfGOhc2kPXzmv4f26NQGBio5P3W1enWAW3n/7Vg46rv/4UOtQNYff7+w8al/8PGpf/DxtWo/1+pS5sLgPWo1NvpFgCd0+L4/5V2twNYfd7/w8a1WP9v55dfAR3Vyv/1L2FhS1bsssopLm/3/8dCeqRWpa6+NpUchY4fwzW1cGDFetPJQsTyyineY+8+MTe/5s57xSLfEw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBm/RcAAP//9N/01g==")
executing program 2:
r0 = socket$kcm(0x11, 0x2, 0x300)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x70bd2d, 0x259fdbfd, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080)
syz_open_dev$usbmon(0x0, 0x1, 0x8a80)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r6 = getpgrp(0x0)
sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r7 = getpid()
sched_setscheduler(r7, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r8 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x1, 0x0)
r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async)
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x108a, 0x0, 0x0, 0x2000020, 0x6}}) (async)
sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x50)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x39b3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48)
ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af839)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20)
recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)=""/83, 0x53}], 0x1}, 0x81}], 0x2, 0x21, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x210006, &(0x7f0000000000), 0x1, 0x56e, &(0x7f0000000e40)="$eJzs3U9vHGcZAPBn1uvEblycAodSqSWCoqSiWcc1bS0ObSMQtwpQuAfL2ViW197gXTexVVWuOHBE4kArceLEBYkPgIT6EVClSvSOAIEqSMoBIcqgmZ1t7M2sa5Ndr+P9/aTxvvPOn+d5d73jd/54JoCxdSEiXouIiYh4LiJmi/pKMcRuZ8jmu3f3zeVsiEji2t+TSIq6iLz4qXPFYlOdl1Kt7Z21pUajvlmMz7XXb821tncur64vrdRX6hsLC/MvLb68+OLilbLFV47azqxdr3z7Lz//6a++88rvnr/9x+t/u/RWlvS3iulFOwbuw/znZPZedP2oGhGbwwg2AtnvTTVvIQAAj4Ksj//5iPhK3v+fjYm8N5fr7dJNHX92AAAAwCCkr87Ef5KINO3u3qcAAADAKfNqRMxEUqkV1wLMRKVSq3Wu4f1iPFZpNFvtr99sbm3cyKblV3pWbq426leKa2rPx2SSjc/n5fvjL/SML0TEExHxcTqdj9eWm41/p2k64sMfAAAAMBbO9ez//3O3s/8PAAAAnDLnjzh/ZUh5AAAAAMNT7P9P9NYnI8gFAAAAGI6jnv8HAAAAHinfe/31bEi7z7++8cb21lrzjcs36q212vrWcm25uXmrttJsruT37Fv/rPU1ms1b34iNrTtz7XqrPdfa3rm+3tzaaF9f9fxAAAAAGJUnvvzeh0lE7H5zOh8yZ6LsnwEKrhWAU+NIt/L4876xs4POBThe/f7MA6dfddQJAKOze/RFLgwjD2Bk9t3qo6RTsPfinX3HDH4/vJwAAIDBuvilJMrO/+dP+h91csBQeZQHjC/n/2F8HfH8//vDygM4fpN6ADD2+j/qY7r/QtN9zv+fKZs5TbslNwIBAIDRmMmHpFIrzgXORKVSq0U8nv+r/2Ryc7VRvxIRn4uIP8xOns3G5/MlE48HBAAAAAAAAAAAAAAAAAAAAAAAAIBDStMk0v6qB00EAAAAHg0Rlb9GtfP8r4uzz870Hh84k/xrNopHet3+xbV37sxOtTfns/p/PN+tb7977Z07S+325gujOIIBAAAA9Orup+ev86POBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBT5ZPbEXffXL5XDMcZ+qOr8d04H3HvgfjVmMpfp2IyIh77OInqnuWSiJgYQPzdtyPiybL4SZZWnC+y6I1fiYjpwcefvD/l0/hPp2laxD+zL/65AcSHcfbe1Yh4rez7X4kLcTbf/kTJ979aDA/ro6v5l7w0fnf7N9Fn+/f4IWM89cFv5vrGfzviqWr59q8bP+kTv1K2wpI35Yc/2Nl5oLKz8kh/GXExyuPvjTXXXr8119reuby6vrRSX6lvLCzMv7T48uKLi1fmbq426sXP0jb+7Onf/ren6pO0I29/PBj/J9H5WA5s/7NZYc8WO9LeMEWwD+7c/cKD1XkDs/iXvlr++T95QPzsd+JrxWeQTb/YLe92yns98+v3nylNrIh/o8/7/1mf/6Wz/da633Pf//GfDjcnAHAcWts7a0uNRn3zUIXpo8y8vbOWphHdmnfTNC2bJ9unPfQK/8/C0Vs6foVu725oIaZOSktPQCHrW5+ANPoVBnFkCwAAOGnud/oPvchbQ00IAAAAAAAAAAAAAAAAAAAAxlBrOyoH3w8sTSMe7nZivTF3R9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD/S8AAP//pe/SIQ==")
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0x7e, 0x4, 0xffff})
r1 = syz_clone(0x22000, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$setsig(0x4203, r1, 0xffffffffffff04be, &(0x7f0000000ac0)={0x35, 0xec50, 0x5})
executing program 4:
recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffe3b}, 0x0) (async)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x34}}, 0x20002000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="0fc7284625c87dc07148b8b9000000000000000f23d00f21f835100000070f23f848b8bcc585fc2fd3c5080f23d00f21f835000000080f23f8660fc7b374000000450fc7720ec48189c6168bc744240060000000c744240200380000ff2c2466baf80cb808122188ef66bafc0ced66ba610066ed", 0x74}], 0x1, 0xb, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4)
sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000040)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x40440a4}, 0x20000018)
executing program 3:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000500)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000600)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000700)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000800)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000b00)='P\x00')
nanosleep(&(0x7f0000000c00)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000000d00), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000000e00), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000000f00), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001000), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001600)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001700)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001800)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000001900)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040341278560001010203010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xb, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000200)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000300))
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_udc.0\n\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x1d6b\n\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='0x0104\n\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0\n\x00', 0xc)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='dummy_udc.0\n\x00', 0xc)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/power/state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='mem\n\x00', 0x4)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 12, 30, 14, 16, 23, 8, 5, 19, 25, 26, 7, 20]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x5f5e100})
ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20)
r1 = socket$phonet(0x23, 0x2, 0x1)
bind$phonet(r1, &(0x7f0000000080)={0x23, 0x2, 0x8}, 0x10)
r2 = socket$phonet_pipe(0x23, 0x805, 0x2)
bind$phonet(r2, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10)
connect$phonet_pipe(r2, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@getaddr={0x0, 0x16, 0x1}, 0x14}}, 0x0)
sendto$phonet(r1, &(0x7f0000000300)="0041010000000000", 0x8, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0x4008aea2, 0x200000)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x10000, &(0x7f0000000000/0x10000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d04, 0x0, 0x1}]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0xf, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0x4, 0x80, 0x2, 0x4, 0x0, 0x7, 0x80000001, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x1000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="23000000010000000500010008000000"]}, 0x20}], 0x1}, 0x0)
r1 = socket$phonet_pipe(0x23, 0x5, 0x2)
bind$phonet(r1, &(0x7f0000000200)={0x23, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'veth0\x00', 0x1})
r2 = socket$phonet(0x23, 0x2, 0x1)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="2300000001000000050001000c000000"]}, 0x20}], 0x1}, 0x0)
bind$phonet(r2, &(0x7f0000000600)={0x23, 0xc}, 0x10)
sendto$phonet(r2, &(0x7f0000000700)="0061010103040000", 0x8, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
sendto$phonet(r2, &(0x7f0000000900)="00640100", 0x4, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x39b3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48)
ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af839)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20)
recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000340)=""/83, 0x53}], 0x1}, 0x81}], 0x2, 0x21, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x210006, &(0x7f0000000000), 0x1, 0x56e, &(0x7f0000000e40)="$eJzs3U9vHGcZAPBn1uvEblycAodSqSWCoqSiWcc1bS0ObSMQtwpQuAfL2ViW197gXTexVVWuOHBE4kArceLEBYkPgIT6EVClSvSOAIEqSMoBIcqgmZ1t7M2sa5Ndr+P9/aTxvvPOn+d5d73jd/54JoCxdSEiXouIiYh4LiJmi/pKMcRuZ8jmu3f3zeVsiEji2t+TSIq6iLz4qXPFYlOdl1Kt7Z21pUajvlmMz7XXb821tncur64vrdRX6hsLC/MvLb68+OLilbLFV47azqxdr3z7Lz//6a++88rvnr/9x+t/u/RWlvS3iulFOwbuw/znZPZedP2oGhGbwwg2AtnvTTVvIQAAj4Ksj//5iPhK3v+fjYm8N5fr7dJNHX92AAAAwCCkr87Ef5KINO3u3qcAAADAKfNqRMxEUqkV1wLMRKVSq3Wu4f1iPFZpNFvtr99sbm3cyKblV3pWbq426leKa2rPx2SSjc/n5fvjL/SML0TEExHxcTqdj9eWm41/p2k64sMfAAAAMBbO9ez//3O3s/8PAAAAnDLnjzh/ZUh5AAAAAMNT7P9P9NYnI8gFAAAAGI6jnv8HAAAAHinfe/31bEi7z7++8cb21lrzjcs36q212vrWcm25uXmrttJsruT37Fv/rPU1ms1b34iNrTtz7XqrPdfa3rm+3tzaaF9f9fxAAAAAGJUnvvzeh0lE7H5zOh8yZ6LsnwEKrhWAU+NIt/L4876xs4POBThe/f7MA6dfddQJAKOze/RFLgwjD2Bk9t3qo6RTsPfinX3HDH4/vJwAAIDBuvilJMrO/+dP+h91csBQeZQHjC/n/2F8HfH8//vDygM4fpN6ADD2+j/qY7r/QtN9zv+fKZs5TbslNwIBAIDRmMmHpFIrzgXORKVSq0U8nv+r/2Ryc7VRvxIRn4uIP8xOns3G5/MlE48HBAAAAAAAAAAAAAAAAAAAAAAAAIBDStMk0v6qB00EAAAAHg0Rlb9GtfP8r4uzz870Hh84k/xrNopHet3+xbV37sxOtTfns/p/PN+tb7977Z07S+325gujOIIBAAAA9Orup+ev86POBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBT5ZPbEXffXL5XDMcZ+qOr8d04H3HvgfjVmMpfp2IyIh77OInqnuWSiJgYQPzdtyPiybL4SZZWnC+y6I1fiYjpwcefvD/l0/hPp2laxD+zL/65AcSHcfbe1Yh4rez7X4kLcTbf/kTJ979aDA/ro6v5l7w0fnf7N9Fn+/f4IWM89cFv5vrGfzviqWr59q8bP+kTv1K2wpI35Yc/2Nl5oLKz8kh/GXExyuPvjTXXXr8119reuby6vrRSX6lvLCzMv7T48uKLi1fmbq426sXP0jb+7Onf/ren6pO0I29/PBj/J9H5WA5s/7NZYc8WO9LeMEWwD+7c/cKD1XkDs/iXvlr++T95QPzsd+JrxWeQTb/YLe92yns98+v3nylNrIh/o8/7/1mf/6Wz/da633Pf//GfDjcnAHAcWts7a0uNRn3zUIXpo8y8vbOWphHdmnfTNC2bJ9unPfQK/8/C0Vs6foVu725oIaZOSktPQCHrW5+ANPoVBnFkCwAAOGnud/oPvchbQ00IAAAAAAAAAAAAAAAAAAAAxlBrOyoH3w8sTSMe7nZivTF3R9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAD/S8AAP//pe/SIQ==")
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0x7e, 0x4, 0xffff})
r1 = syz_clone(0x22000, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$setsig(0x4203, r1, 0xffffffffffff04be, &(0x7f0000000ac0)={0x35, 0xec50, 0x5})
executing program 4:
recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffe3b}, 0x0) (async)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x34}}, 0x20002000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="0fc7284625c87dc07148b8b9000000000000000f23d00f21f835100000070f23f848b8bcc585fc2fd3c5080f23d00f21f835000000080f23f8660fc7b374000000450fc7720ec48189c6168bc744240060000000c744240200380000ff2c2466baf80cb808122188ef66bafc0ced66ba610066ed", 0x74}], 0x1, 0xb, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4)
sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000040)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x40440a4}, 0x20000018)
executing program 3:
r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40700a001000102030109022000010100803209040000020806f2000705020240000007058102400000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb)
close(r2)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000500)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000600)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000700)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000800)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000900)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x100, &(0x7f0000000a00)='\x00'/256)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000b00)='P\x00')
nanosleep(&(0x7f0000000c00)={0x2}, 0x0)
r3 = syz_open_dev$sg(&(0x7f0000000d00), 0x0, 0x2)
r4 = syz_open_dev$sg(&(0x7f0000000e00), 0x1, 0x2)
r5 = syz_open_dev$sg(&(0x7f0000000f00), 0x2, 0x2)
r6 = syz_open_dev$sg(&(0x7f0000001000), 0x3, 0x2)
ioctl$SG_IO(r3, 0x2285, &(0x7f0000001600)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r4, 0x2285, &(0x7f0000001700)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r5, 0x2285, &(0x7f0000001800)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
ioctl$SG_IO(r6, 0x2285, &(0x7f0000001900)={0x53, 0xfffffffe, 0xa, 0x20, @buffer={0x0, 0x200, &(0x7f0000001300)}, &(0x7f0000001200)="2a000000000000000100", &(0x7f0000001400), 0x4e20, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)
executing program 1:
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040341278560001010203010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xb, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000200)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000300))
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='dummy_udc.0\n\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x1d6b\n\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='0x0104\n\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000500)='dummy_udc.0\n\x00', 0xc)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='dummy_udc.0\n\x00', 0xc)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/power/state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='mem\n\x00', 0x4)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 12, 30, 14, 16, 23, 26]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x5f5e100})
ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20)
r1 = socket$phonet(0x23, 0x2, 0x1)
bind$phonet(r1, &(0x7f0000000080)={0x23, 0x2, 0x8}, 0x10)
r2 = socket$phonet_pipe(0x23, 0x805, 0x2)
bind$phonet(r2, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10)
connect$phonet_pipe(r2, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=@getaddr={0x0, 0x16, 0x1}, 0x14}}, 0x0)
sendto$phonet(r1, &(0x7f0000000300)="0041010000000000", 0x8, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0x4008aea2, 0x200000)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x10000, &(0x7f0000000000/0x10000)=nil})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d04, 0x0, 0x1}]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0xf, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0x4, 0x80, 0x2, 0x4, 0x0, 0x7, 0x80000001, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe})
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x1000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="23000000010000000500010008000000"]}, 0x20}], 0x1}, 0x0)
r1 = socket$phonet_pipe(0x23, 0x5, 0x2)
bind$phonet(r1, &(0x7f0000000200)={0x23, 0x8}, 0x10)
setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'veth0\x00', 0x1})
r2 = socket$phonet(0x23, 0x2, 0x1)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)={0x20, 0x14, 0x1, 0x0, 0x0, "", [@generic="2300000001000000050001000c000000"]}, 0x20}], 0x1}, 0x0)
bind$phonet(r2, &(0x7f0000000600)={0x23, 0xc}, 0x10)
sendto$phonet(r2, &(0x7f0000000700)="0061010103040000", 0x8, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
sendto$phonet(r2, &(0x7f0000000900)="00640100", 0x4, 0x0, &(0x7f0000000800)={0x23, 0x8}, 0x10)
nanosleep(&(0x7f0000000a00)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 14, 16, 23, 26]
detailed listing:
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 23, 26]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='60\x00', 0x3)
close(r0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0)
write(r2, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00', 0x6)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0)
write(r3, &(0x7f0000000a00)='0\x00', 0x2)
close(r3)
executing program 4:
syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401111111100010000000109023e00010100c0000904000000080662000705010200020004240100070582020002000424020007058302000200042403000705040200020004240400"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/drivers/uas/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000540)='1-1:1.0', 0x7)
write(r0, &(0x7f0000000580)='2-1:1.0', 0x7)
write(r0, &(0x7f00000005c0)='3-1:1.0', 0x7)
write(r0, &(0x7f0000000800)='4-1:1.0', 0x7)
write(r0, &(0x7f0000000840)='5-1:1.0', 0x7)
write(r0, &(0x7f0000000880)='6-1:1.0', 0x7)
write(r0, &(0x7f00000008c0)='7-1:1.0', 0x7)
write(r0, &(0x7f0000000900)='8-1:1.0', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/drivers/uas/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000640)='1-1:1.0', 0x7)
write(r1, &(0x7f0000000680)='2-1:1.0', 0x7)
write(r1, &(0x7f00000006c0)='3-1:1.0', 0x7)
write(r1, &(0x7f0000000700)='4-1:1.0', 0x7)
write(r1, &(0x7f0000000740)='5-1:1.0', 0x7)
write(r1, &(0x7f0000000780)='6-1:1.0', 0x7)
write(r1, &(0x7f00000007c0)='7-1:1.0', 0x7)
write(r1, &(0x7f0000000940)='8-1:1.0', 0x7)
close(r1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 14, 26]
detailed listing:
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 26]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./rpc_pipefs\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='1\n\x00', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./export\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./rpc_pipefs/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='* ./export 3600 0 0 0 0\n\x00', 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000340)='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,clientaddr=127.0.0.1,timeo=1,retrans=1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/testfile\x00', 0x42, 0x1ff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 26]
detailed listing:
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001000)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001940)={0x84, &(0x7f0000001a00)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001840)={0x84, &(0x7f0000001900)={0x40, 0x6, 0x5, '\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, &(0x7f0000001800)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001640)={0x84, &(0x7f0000001700)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001540)={0x84, &(0x7f0000001600)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001440)={0x84, &(0x7f0000001500)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001240)={0x84, &(0x7f0000001300)={0x40, 0x6, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001140)={0x84, &(0x7f0000001200)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001040)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000f40)={0x40, 0x6, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x84, &(0x7f0000000e40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c80)={0x84, &(0x7f0000000d40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000c40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000b40)={0x40, 0x6, 0x4, 'APP '}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000a40)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000840)={0x40, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='apple,cd321x 0x38\n\x00', 0x13) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys_mnt\x00', 0x1ff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000740)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x6, 0x4, "01020304"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_control_io(r0, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000440)={0x40, 0x3, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 26]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000340)={0x40, 0x1, 0x4, "01000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 26]
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26]
detailed listing:
executing program 0:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)
close(r4)

program did not crash
minimized 30 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 25]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)
close(r5)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 24]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)
write(r5, &(0x7f0000000800)='\n\x00', 0x1)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 23]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
r5 = openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r5, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 22]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')
openat(r4, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 21]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00')

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 20]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 19]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)
mkdirat(r4, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 18]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)
mkdirat(r4, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 17]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 16]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)
close(r3)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 15]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='0000:00:02.0\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 14]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 13]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)
close(r2)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 12]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 11]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)
close(r1)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 9]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 8]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 7]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)
close(r0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 6]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
executing program 0:
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
minimized 26 calls -> 4 calls
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
bisect: concatenation succeeded
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m21.009945238s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program did not crash
simplifying guilty program options
testing program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in dummy_udc_start
extracting C reproducer
testing compiled C program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program did not crash
testing program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
extracting C reproducer
testing compiled C program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
program did not crash
testing program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
validation run: crashed=true
testing program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
validation run: crashed=true
testing program (duration=1m21.009945238s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc)

program crashed: general protection fault in set_link_state
validation run: crashed=true
reproducing took 3h41m40.842972594s
repro crashed as (corrupted=false):
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 1 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5841 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:set_link_state+0x27/0x1000 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 70 9a 08 fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 ab 14 77 fa 49 8b 16 4d 8d a6 a3 00
RSP: 0018:ffffc900030d7b20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032245dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200061af60 R12: 0000000000000246
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00005555729ec500(0000) GS:ffff888124df8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055be83512070 CR3: 0000000070b40000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dummy_pullup+0xc4/0x120 drivers/usb/gadget/udc/dummy_hcd.c:933
 usb_gadget_disconnect_locked+0x126/0x480 drivers/usb/gadget/udc/core.c:785
 gadget_unbind_driver+0xc2/0x410 drivers/usb/gadget/udc/core.c:1718
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1435
 bus_remove_driver+0x226/0x320 drivers/base/bus.c:832
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1784
 raw_release+0xd7/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
 do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff16679e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdecc69e28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffdecc69f10 RCX: 00007ff16679e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000173da R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b33720000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff166a25fac R14: 00007ff166a25fa8 R15: 00007ff166a25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:set_link_state+0x27/0x1000 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 70 9a 08 fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 ab 14 77 fa 49 8b 16 4d 8d a6 a3 00
RSP: 0018:ffffc900030d7b20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032245dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200061af60 R12: 0000000000000246
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00005555729ec500(0000) GS:ffff888124df8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055be83512070 CR3: 0000000070b40000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	55                   	push   %rbp
   4:	41 57                	push   %r15
   6:	41 56                	push   %r14
   8:	41 55                	push   %r13
   a:	41 54                	push   %r12
   c:	53                   	push   %rbx
   d:	48 83 ec 38          	sub    $0x38,%rsp
  11:	49 89 fe             	mov    %rdi,%r14
  14:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  1b:	fc ff df
  1e:	e8 70 9a 08 fa       	call   0xfa089a93
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 ab 14 77 fa       	call   0xfa7714e3
  38:	49 8b 16             	mov    (%r14),%rdx
  3b:	4d                   	rex.WRB
  3c:	8d                   	.byte 0x8d
  3d:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
  3e:	a3                   	.byte 0xa3

final repro crashed as (corrupted=false):
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 1 deregistered
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5841 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:set_link_state+0x27/0x1000 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 70 9a 08 fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 ab 14 77 fa 49 8b 16 4d 8d a6 a3 00
RSP: 0018:ffffc900030d7b20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032245dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200061af60 R12: 0000000000000246
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00005555729ec500(0000) GS:ffff888124df8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055be83512070 CR3: 0000000070b40000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dummy_pullup+0xc4/0x120 drivers/usb/gadget/udc/dummy_hcd.c:933
 usb_gadget_disconnect_locked+0x126/0x480 drivers/usb/gadget/udc/core.c:785
 gadget_unbind_driver+0xc2/0x410 drivers/usb/gadget/udc/core.c:1718
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1435
 bus_remove_driver+0x226/0x320 drivers/base/bus.c:832
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1784
 raw_release+0xd7/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
 do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff16679e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdecc69e28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffdecc69f10 RCX: 00007ff16679e0d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000173da R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b33720000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff166a25fac R14: 00007ff166a25fa8 R15: 00007ff166a25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:set_link_state+0x27/0x1000 drivers/usb/gadget/udc/dummy_hcd.c:455
Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 70 9a 08 fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 ab 14 77 fa 49 8b 16 4d 8d a6 a3 00
RSP: 0018:ffffc900030d7b20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888032245dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200061af60 R12: 0000000000000246
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00005555729ec500(0000) GS:ffff888124df8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055be83512070 CR3: 0000000070b40000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	55                   	push   %rbp
   4:	41 57                	push   %r15
   6:	41 56                	push   %r14
   8:	41 55                	push   %r13
   a:	41 54                	push   %r12
   c:	53                   	push   %rbx
   d:	48 83 ec 38          	sub    $0x38,%rsp
  11:	49 89 fe             	mov    %rdi,%r14
  14:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  1b:	fc ff df
  1e:	e8 70 9a 08 fa       	call   0xfa089a93
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 ab 14 77 fa       	call   0xfa7714e3
  38:	49 8b 16             	mov    (%r14),%rdx
  3b:	4d                   	rex.WRB
  3c:	8d                   	.byte 0x8d
  3d:	a6                   	cmpsb  %es:(%rdi),%ds:(%rsi)
  3e:	a3                   	.byte 0xa3