Extracting prog: 1h38m48.369988122s Minimizing prog: 4h59m25.813922962s Simplifying prog options: 13m27.840715124s Extracting C: 5m14.569995527s Simplifying C: 0s extracting reproducer from 72 programs testing a last program of every proc single: executing 22 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-pipe2$9p-bpf$BPF_PROG_TEST_RUN-getpgrp-sched_setaffinity-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-modify_ldt$write-socket$inet6_tcp-connect$inet6-write$binfmt_script detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x220814, 0x0, 0x1, 0x0, 0x0) pipe2$9p(0x0, 0x800) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000380)={0xffffffffffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffff68, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20000009}, 0x50) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) modify_ldt$write(0x1, &(0x7f0000001700), 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r4, &(0x7f0000000200), 0xfffffd9d) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-pipe2$9p-bpf$BPF_PROG_TEST_RUN-getpgrp-sched_setaffinity-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-modify_ldt$write-socket$inet6_tcp-connect$inet6-write$binfmt_script detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x220814, 0x0, 0x1, 0x0, 0x0) pipe2$9p(0x0, 0x800) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000380)={0xffffffffffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffff68, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20000009}, 0x50) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) modify_ldt$write(0x1, &(0x7f0000001700), 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r4, &(0x7f0000000200), 0xfffffd9d) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-mmap-socket-socket-socket$nl_sock_diag-sendmsg$SOCK_DIAG_BY_FAMILY detailed listing: executing program 0: unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x2b, 0x80801, 0x1) socket(0x2b, 0x80801, 0x1) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x13, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_generic-openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-syz_genetlink_get_family_id$nl80211 detailed listing: executing program 0: sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x4, 0xfffb}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003040)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-mmap-socket-socket-socket$nl_sock_diag-sendmsg$SOCK_DIAG_BY_FAMILY detailed listing: executing program 0: unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x2b, 0x80801, 0x1) socket(0x2b, 0x80801, 0x1) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x13, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_generic-openat$tun-ioctl$TUNSETIFF-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-syz_genetlink_get_family_id$nl80211 detailed listing: executing program 0: sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x4, 0xfffb}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003040)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$printer-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socketpair$unix-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-rseq-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$sndtimer-syz_open_procfs-openat$binderfs-ioctl$BINDER_FREEZE-write$binfmt_script-ioctl$KDGKBDIACR-sendmmsg$unix-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$tty1-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$vsock_stream detailed listing: executing program 0: syz_usb_connect$printer(0x2, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12011003000000402505a8a44000010203010902240001010680ac0904005602070102ffa3400af4dea2ce1606090582022000090154"], &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0}) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) rseq(&(0x7f0000000340)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000015c0)=[{{&(0x7f0000000380)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000b40)=[{&(0x7f00000006c0)="13c04b6102d65ca24b8016ec71bafdf31b247700211963b116ec3a6693ef36c35fe09b5b5c7a8f8becf8687a23da355eb1c28be66d274776b05916e2d43c9d5fcb69c60804e2961334e51e7b7d3368ef8b4696e254fec25f2a736ffb19dbb4a3cfe23c63271dc9706be346e9c0dd02b9d09b72a09826dd5e15b9a16d17685f5c340db9406e917f0c", 0x88}, {&(0x7f0000000580)="03490f1e7a6970ed252b9b42f8d503dab89a435f70c8728836b81df8f3f149be8099f5fd0eff807466ad0bda06f1894a377463fb4d391896e1b1d9ff1a7ad9479eaa3809f9011b0345d230ce58acbc524d7f4fb8be89d7878c9ff414174d8da6907360632646253ab903707f713d85feb79d9e16be64d2972fd41b1034c6", 0x7e}, {&(0x7f0000000780)="ae2138b780a255ef61cdfb72de8aa43067e7fbb82ce8d824ea513e16be9dab0d467a9515c816d7bb149b96c8fd8f221bfc149e9c8713541dc8cf042c322cdb75b08a2e995ad3511cce2f89f2ed726c39dd62a7907e4fa106575a7b37b064e67cbc2e2357c022b2b1b295ce048aa8b6f1b6f9a9de2173ffb14cbcf479e638e0724cbc75f898346126c01638ad5ab3412b022cb8c4129c95ca8c218aef41f26f2685f25651010c9074515f16a3f5e7ecd8b9741e727aa6483a38bcf3f6c99db1a064220a40", 0xc4}, {&(0x7f0000000000)="132695d269295eadeabab35d462082fabf1824ea57bed9d25d5145d10a96ab2e9496af6cf5249961dc88588756799015aaa282c31359f898", 0x38}, {&(0x7f0000000880)="1514f4486313497240361a481f284c718559e6499188bf2d70826a1dcb00c0202b81f807f4029990c2ea27e38a6bf108d68620e5868c1dce8f98969db64b9df0b587c4bc5d5f866c5ecc3f0141ef79fa124159a63553f22ad1d472035fddf4db55c2b5f64fc320", 0xb}, {&(0x7f0000000900)="24eaca796bf3f283375c7d0e2c4120bbfcf222dacbeb585ba1ac5a6dd89432a4d2fd1bb5aee91b40615e3d660856296d93792fbe5e6a1c430ba87ee9c84f81b462b1ed88023a9525333d6fb7921acf81863cd1acb5bc2eef0dec47e061151b08b06a0bc808c47f3e4ec79aa7a5a6a1d3d0a861f7fad92ec7b70ea8255b5a1dbf5b98916da1b0b59a7c1fe2e7b28ea35e3ee2", 0x92}, {&(0x7f0000000a40)="856686d7eef7c3b67c89b49da32f0d9ddbb44e2c8a2915ec488cbb1062e6ca61556b8774ea8f64b98d851c3ebd6a4b4f78dfb558809494f7ada80f78cd73fdcb542e1dac5b9e8afd9d40cc1d955554e9b4ae1a5a5bec317b97a0256946c6f010b2b293e4ae969621ed9cb05f1734c7c4f09382ab8d1b3a155ed1ca2fd0f811f30109ba9a0e1791aac20a1d4a1e0e1eee6a87df6ff5c9233cddc064d1ad72cb3fdc827613b37a0c95924817e0ffb20d2006fb9a93adafd64444873118482daab726925648e5ef214d601f5a2a3d2d88a65e9a", 0xd2}], 0x7, &(0x7f0000000e40)=[@rights={{0x28, 0x1, 0x1, [r0, r3, r1, r0, r5, r1]}}, @rights={{0x24, 0x1, 0x1, [r0, r6, r3, r6, r0]}}, @rights={{0x18, 0x1, 0x1, [r6, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [r1, r2, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r4}}}, @cred={{0x1c}}], 0xd0, 0x4}}, {{&(0x7f0000000f40)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000fc0)=[{&(0x7f00000011c0)="fb68c0e8d706f6c35e334fa2374b647c1328a88803a256d53fe44a544e140b892553f983b6f31a2d0ffc857f29b99d18ad87d92e6360f539ada8a09f31ac8a496a7cb4819c42859535db1190f7754ff3a2224942a526dd5290cce9735c14e5b94f9be516c41e6b082f98cd9141a85373be69aa7db3f944098d818fa58c19e5b2789146950e6c95315b0e895d55b6cd56a4c7342c48eefc1c325957f57f3bcf2e8d1735e7e2e5fa865246a680540c45fbc4b3fd3e48", 0xb5}, {&(0x7f0000001280)="31ecbb017abb4fb7f73bbdd3e720d728e647972f78d59d37fa228274366541f1291273255a722aab2217fede3e9bc00127110bcc4531be57cfe3168a72556700127392c242c3d7231e81d7b808a42113c9026f619e32797587dad381317b30ffbe80334df9bbc79572a2c3f618ebd2601b080bac8d018dcdd58ccad0c2ab4ebd0f152f8c22970caa04e23692ab1e7ec26635b09095d9b9713f777d2434f050018e064d9aa5ac829fe86c8623ea60e0e9beb1636f66fe88db52a405b73c013ee8", 0xc0}, {&(0x7f0000002140)="eb600441e4afdba1ffa0727e1c25c6ebc793f6bbfe5447cfa36f9b725e5ea9217b1455cea0b461d0d080879d97c7f8b9cf9ba2ddca479e8da9d843a6db6d3c1d0ac347d96c0b9f4ec7d6488bf4b4d5c6c9d184a0af722519fb605526a0b1dbf353e482e7bbe81215ab0a4c970ff9e76f3f7aae4c29e600c76896ba39b1cb7c06b7febb9911cbb06b15aea31e78a487efb9a788a43281c83535ffc0d8a1769b1a9004f95c837ccead7a964f87858f9347d7472a0f6ff5f32f841b1d6d20e256a07f140d28da11321f398661579ee88b73e16d3cde77458006cfd2f15df5bfa8f4092e848fb4da005f552a2ab3ae35dda984e5092895c791f58ac640351fce0905b1837188ae2e4b27bbab562e4ee4c28497a4fd1cee6c8809045f96ac2bc4c5651d731d40257b08c86ce5f431a73a6f3918f1634970c2fea475f65dda2d63b06c15e4805b2c652cb551c8444cd5743bcd5eb317bb98d6b61d01c01a511976447a52e2b6371941b9ba2867f58781af3b394809b2d98b831d3e5d9a0769ca6851ddef7b49ddda411be7aa4d91408cf871fd5bc443b75dc4c9efb415746350655f886975f6409c6e3e9b1c56d7e8bfe90dca9265a23156a6fe43e4e0d740b19702b8a14a72d53286f3d26e1fdb1e9531ee23e5b0d264f7be28bd918fee6269117b4db6a4455ffdf81c380e73f30526f82f09923ba7fa168ead8191d05b2a722e682ba240ad9f9a388b870d7699a15128d9b592b3113f5d3bf91cea66f9143d63144ea62eb1a821d0a21ab523de5813617556faf62d8e7f9df92cfd5c35f5bfae8709dfc4730231dd49228ed6d74699dec620d3146d5badd16ae4f153072c88dae2262d63f4fb6a7378b5be743f3777e0610b0d499db58b60105c29c3da54e52bd0b74d9ed8538eed53edbee5379e30c32221789158142579cec5c0edf36dadc8157cc1a39eb0c2fd1390c5fca16918252b2859ee15a6b3c1873afc717c789a9add61af154c5d1968bbaa4d3078e63a9907423250979cbb324d5c6828598cea1238a622a04ae330a82a3d6b34ad6706f00135f53f4977e0c62e5238ce4c957cc112bf0e8c982b77e53b2817e058e0ba05754073cc501c948e6810a22ae4b983a8c858c9a0dbeb51905a32a34bbd98fdc9d7f5bbe30d29eda1d671eda780d317bb557e847f85e1697ffd4e572810e42b9d580cefe8ec09cac2d2d4e8cf0cf715a2e378a4459c1c8af9f92590488255114a5f79ca2b7fe368f27d7d1554206afc3c457e7f2b89c33094297c421df4828f5465e9a8b1e849168d91c9e41cc06502e1303805f8ed8579512e1f8e0439c9e1e896742fd85e3787781b1450e04ebbe05ca07e0a10262ee76c7cb0a1f1f9fd27d5d3266b61efd8e136a718455599424f8c76f6bd7c2d71ddd71af8aafa69e5845c0f936a6657a8a8f997de52df98fdcc66796baaec7fe6e61f614ba80fb70b7e8a8ca524b0bdeed176281f08ee210977bcbe178ae5a282a28860d62f7e4979ea72ccad099b05d3aa794decc191ad27aa79168e9a00420b220adae5e4e1aca6cc47c4e7ba2c7a9c6f16008e1fb252831393c8fa4d9c878741554ae04a81705e1fee57762bb584fa588416e38c895dc0b9259906a87bd4a0b40a0d32a0f3ac33cc71924075acba086029c026d97713b431175e44ad1cb31a2660b0209fbb635944c901034d73539b56e43620739531c1a4c30fc4d724d4c9aaff2ed9898f18c59b4168adc7a8c5b18ff8c9a5737c45de29f78d21c543b57ec5342466fe7cf3c90571adee88169052eaab9cdbe59e6716ad9ad8d03709161aa5bb8a5ddbf349b123f78ed359c09233a86d595ebd248752a65ceb3bba710ed7578d21765080d55ca37ffff16721815db5f0e4c8ff890b338b2318ee4e547f357bd4b6b8206ff8b418abae0bcde47823d1505c13b431762968df06d3745258f181ab3f186f77920c8889d43cc79db91c15aa65ed0b2e3af407e747211707a1d58ab2b7b92f49225b89901b54e9b5a4c2428b7bfbd920c7c4ee21f017bffb8d23885d78184fe95c3e5189234d2c9a257edcf93498efacb278fc2841a548ea8fde954f0ac669f5eb420c043cd9ef57073cbb287d432da9fa1502e0c0e7d8506cf646b8740bc368fed5338ee035d2ad8ccb0c57fe0882bee2f6ab35a9b3e6769c0aa419cb2bdf1e6748ff440e08a995409e93c0d0db3d29ae290ec37699e47fef7aa0241dfb4fb622af287a82569daa49f00efea566cbeac324e81976bd6d94935e35cfe88ec3686e908f9bb78354a5fc282f12b20898b96cc41a921659f74dca5e42339b05226c3cf5b3f4842b8432412967aacb480791810ac947a05e21691f5ca47680956b54a72566d39551bc1cda4b4ed89f794add71ccd4a01fb6552bc0c6cc1d7060dc86c7930cb309ab433997fd3a89ec97caa26c6fd21a8471eab42267d327da7e1a5f0ad166549f6d5bcde4e762ab339650c7b6a468a50ae455c4f8bb46c95b1d36daddc786952035949359cc2006df4d83d61c30ec91d28e5186c7b32bbc779ec3e51726bfac39f7263a11f2eeda3a3fc111e00c0c0f08e62c7d5eeb9dc19a596b56ef4a6b76703d42a9317e7269c9917795944ba7b59b479953280f253364a3e3bfb3c8969507ffd3fde77e0ad2aace2c2a7f1c2a686bee8c6bc0a2e3b96f8efce26a8fbca96570198a8073cb9c915829aabee2519f303f9d920998b688201cc9dced2489c9380780a2c7d44c893f801e778833487ec1e3a53c52551f0590bfe84391897783acec9acd4f92172930259153b02f7213867dfd9b2a19a979a15c0e5daff5f8a6564b0ea4d138113914e5ad545311b9ae75b674fda36f9a196462e072223f3584faf39afa863a47c2c5353efd9fcce877ace03122b6e22a981f2e37df156eb90fdfff287704a4ac5f54664a765d134e005282e1b619a642f9a0a334ac53ed1049e8f83d34ba1a131a05c803666bf12a2b5e498eaea07737e7758dfa766ac7da88ea6df4261e3466233be761c5b55ffe4049ee756f078b97d5fd8aec94737f6039701483cd095363b494adb7ab0b7953324249f008052097e997e00e4b5ae65cd4f6cee9e78318965ceeec068c01d63d0086a69c1300fca4351702e98d0717ceff011689a2648168d20d29795508ac1b8edca439652b92c5b22e5391ce496324f73f0aaf3fc592c375c2a9ee8f67793d990577b52e0075ae92cf80395579b9e54eff32d34e48f2473992af40513ef6df543a4f1f5bc15358b823a1bb0591ab7ff222f019c820f06b172fe9d1a44fe7893d80cab34adfd8cb86de6ec65548c467ed6dae4fc59d7b517590f16aea50bc931b2e3ebc35ef01e46f383ba3e12df1864b61f3dce87bc07e1635f86317a65659ac163cf4bcd949f0dec1ffcd79eb740b38376f298662f666d214be9bcda0808e69209c92e2b8a715fd0eff03a6f576efc37085f321877889617b0f76a397019bf81c902111f6a84bfb00d2abba55976c45ff59a483910ace4f03442d68aa327f3aed8d814944483bd760090be4e5c55581fef52eb9d8f72e560b58fd50b19a025536dc9db9d77c1ae4918b85dbb4f14275a0851a7c034dfeed13edf8c188c238a732a56e25a368f7d8f97bf2d1dbb6798b40d41d6fedd87c88ddb5f56b3504be066f208b44e2c96a0d743e468099488ddf898f6e8483f011e06c8bc319670173dda3e2abf3353895b6d870638d2a85418d0fc839437037c4a9a4773942ad1569322b921593caa6589d456cd87985606638ab3fb4f86085a945440c752b8d39755eba1825422da4ef0775496aefbab1c977615dd04cfdccc21ac512656e971fa24e0dff339399be60feee7586e16b7189866611b640465dcb87e36297601954d7b53474c9ac0f29e0cbdaf0d8a1e80a6cef4e715a8b9da7fdcf8518b5175d38f898cbeefe34d96fe1c5371aa458360e6ff82420c320d26ed809d0971886b1f1f1c81c3d981b79a78216f0fc7bffd957c239bdbb48d3a70b3b040173d0fb7df745562f7a394801b28babdb6f843ecf5afbfe111f5f51d6a63e2cb662ceaef9d7e192573ebd6efa3183e061a6e03dd34c50730f7630f4e57c71286618c2a28309d97bdd2f24fa96c8efe74b607ccaee2d088b22455b358336be8887161128600e9de7035f8a93d02c0c87b40b61bdf0f427e30d0adec3be7f1a7ff8e034bbac4dccf7b51e93c04ee13bfb5668f393601e6b0441eae8af5417d495f7528d2d37c41ea0c35acd8f89373b8d86b0db83d5258c0e255dfb2ba275fbf58a75bd792176748c8ce1541332b2a50bcf88bfaa8d4dfc681dbe1085ac63d05cd5adbd3b59d2068b884632bac81d6ad8db7b516d1e1d37f122c0c02a2547f7865a1d6525325991b0c73f058d1be2e39b0e0c57b5c0d378444c5e3411402f099703d9bf35d9d2b032daaed936cdf18ad0b73b3e82a03b4c821871bbc0bbf91f96ce596868ff0cf482187d9cd35cdc546ba359ea9e59fd951a50fb9e12d31351cc9d40ccb2cead3377abae8a3dffee4332c7ce96ab70eeee267671e40d83e10c79127824c9bf63d1cac5b8fd13fb5336f3f05b6d5e40eddbdcc0ee6104f7128be0728faba0a9c9509796577db355acb51a02cfcb128d9efdc9df77522e15337d8099fcdc68bd4a8347274ba029d0927d713ff565782bebedd5ea5c2e51dff5cd6a1d35f757ca309b09685152aa430c62bed25b8e28ade3586c9c3f86781794a44d3a72dc6ac2f6d36c66eb6cd0540613d17633bf4d309e49e02222caa23419b268b4c323b4eeb86b43334b920e8121f540b1a731f64348cbd4529ecfaba5a6fa5b67d0c2f074920369bfb08c34683d0f0f92495941c0c245b13e615143df97e155de745468959e54c5958a449fc55fbe2c3c217f9c0dcaab44970a0061e43e1af995957c8f825281456534dfdf3f07c26e1ff2b5f8150fd6e141f5ace28f6d7c9c0cb3fdf1681a69b90be5e9f7cde6f9d640ef5a9acdb15573dcf28c01e913353c3013f82b212b8500296a0a225a22ba328bfbbacc5de42d9051050e5ea8eb12755274b011c6f7e2a3f37e1d7c331bf024d311c858753534ddf35000a6c218a259105f89c6edcb831cc66ace10b052212bfe16f6b1904e04f8c961170f4650fc9e4634ade0c4a42bd5c17635fd55d92582f1736eb102ea21890243d03f72517ecaed6fe38bc849d4541b845897c90f7ed5d7b93de10dac83262980dbb27c5fc46a2df86e8c9b51720cf143ee6d26c233f062352a143b0de2a024c99c84cecef6c106fb56586ebdfc86f37141cd526e0ed235d3181dcbced599b720f49bd85e9d90c7875bb5040a92ef5edec909bfe4d81ff5f65156effe35b9b4a9f7bc0a1eb396170da1294801290122672f8cef2d46fc0bc7be691a1052fc720d788e04669bccaab0c4792f2faff3494e180ab2dede03d1c0d2f0ffa2d3a3925583148ebefb62b47fb17122c6cccb34710456537733a529dc721664eb9563931998e3432dd3ba27da7eb3fb13952c436a8ae8a1c3c13c93acadd8ccb2791632f0c715f2234443b7e8cb38e19df489da54ee144cd41051267c98906e21b67193a2fd6f2c6e5cb948b32400d7e118e91195502fb990303a9eec469e2be432942fbce52386d92be8b486ea18cda75015ebb7d81da6c40fa86938f19aa13a924e24c21de6734cca76a2f8c38cafcf38944a44545cd8e86d30da21c91b774abcd050b022a9a1a03ab6934a5ee6f543c3cb43f848bd1bc94befb796a9aff3f346c00b22c813ca0a26db91875740bb9c55b73051", 0x1000}], 0x3, &(0x7f00000014c0)=[@cred={{0x1c, 0x1, 0x2, {r4}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [r0, r2, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r5]}}], 0xe0}}], 0x2, 0x20000000) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x101) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='attr/current\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000100)={0x0, 0x1, 0x800}) write$binfmt_script(r7, &(0x7f0000000180)={'#! ', './file0'}, 0xb) ioctl$KDGKBDIACR(r7, 0x4b4a, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x20000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x0, 0x7, 0x0, &(0x7f0000000100)="bdb808dc8568b3", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) syz_open_dev$tty1(0xc, 0x4, 0x3) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x80000000, 0xbd, 0x200, 0x2, r7, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x4}, 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000500)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x36, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r10}, 0x18) socket$vsock_stream(0x28, 0x1, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): connect$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$netlink-writev detailed listing: executing program 0: connect$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee0000", 0x4d}], 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): connect$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$netlink-writev detailed listing: executing program 0: connect$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee0000", 0x4d}], 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): set_mempolicy-openat$cgroup_ro-bpf$PROG_LOAD-bpf$MAP_UPDATE_ELEM_TAIL_CALL-userfaultfd-ioctl$UFFDIO_API-mprotect-ioctl$UFFDIO_ZEROPAGE-ioctl$MON_IOCX_GET-mmap-bpf$BPF_GET_BTF_INFO-bpf$PROG_LOAD-syz_init_net_socket$nl_generic-socket$inet_dccp-getsockopt$inet_int-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-madvise detailed listing: executing program 0: set_mempolicy(0x4003, &(0x7f0000000200)=0x7, 0x3) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.self_freezing\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), 0x0}, 0x20) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000600)={&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000180)=""/15, 0xf}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={r0, 0x20, &(0x7f0000000540)={&(0x7f00000004c0)=""/83, 0x53, 0x0, &(0x7f0000001080)=""/4096, 0x1000}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xa, 0x26, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x63e}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffffb}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffcb}}, @call={0x85, 0x0, 0x0, 0x1f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @generic={0x0, 0x2, 0x4, 0x2, 0x7bb4}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x6, r0, 0x8, &(0x7f0000000240)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x2, 0x4, 0x80}, 0x10, r3, r0, 0x0, &(0x7f00000005c0)=[r0, r1, r0, r1, r0, r0, r1], &(0x7f0000000600)}, 0x94) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r5, 0x10d, 0xd5, &(0x7f0000001040), &(0x7f00000000c0)=0x4) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r4) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, r6, 0x1, 0xffffff80, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x80}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x38}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): set_mempolicy-openat$cgroup_ro-bpf$PROG_LOAD-bpf$MAP_UPDATE_ELEM_TAIL_CALL-userfaultfd-ioctl$UFFDIO_API-mprotect-ioctl$UFFDIO_ZEROPAGE-ioctl$MON_IOCX_GET-mmap-bpf$BPF_GET_BTF_INFO-bpf$PROG_LOAD-syz_init_net_socket$nl_generic-socket$inet_dccp-getsockopt$inet_int-syz_genetlink_get_family_id$netlbl_cipso-sendmsg$NLBL_CIPSOV4_C_ADD-madvise detailed listing: executing program 0: set_mempolicy(0x4003, &(0x7f0000000200)=0x7, 0x3) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.self_freezing\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), 0x0}, 0x20) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000600)={&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000180)=""/15, 0xf}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={r0, 0x20, &(0x7f0000000540)={&(0x7f00000004c0)=""/83, 0x53, 0x0, &(0x7f0000001080)=""/4096, 0x1000}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xa, 0x26, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x63e}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffffb}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffcb}}, @call={0x85, 0x0, 0x0, 0x1f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @generic={0x0, 0x2, 0x4, 0x2, 0x7bb4}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x6, r0, 0x8, &(0x7f0000000240)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x2, 0x4, 0x80}, 0x10, r3, r0, 0x0, &(0x7f00000005c0)=[r0, r1, r0, r1, r0, r0, r1], &(0x7f0000000600)}, 0x94) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r5, 0x10d, 0xd5, &(0x7f0000001040), &(0x7f00000000c0)=0x4) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r4) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, r6, 0x1, 0xffffff80, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x80}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x38}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-syz_init_net_socket$llc-connect$llc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_open_dev$sg-ioctl$SG_IO-fcntl$dupfd-write$sndseq-syz_usb_connect-syz_usb_control_io-write$sndseq-read$snapshot-read$char_usb-ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL-sendmmsg detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r1, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='contention_begin\x00', r2}, 0x18) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x3c, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x40088) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r6, 0x2285, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) write$sndseq(r7, &(0x7f0000000180)=[{0x0, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x80}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) r8 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000b529708410e42416ed401020301090224000100000000090400020221f7680009050100000401ff0709050210", @ANYBLOB="11a74b79"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) write$sndseq(r7, &(0x7f0000000200)=[{0x0, 0x2, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x9, 0x13, 0x29, @time={0x401, 0x5}, {0x4, 0x81}, {0x0, 0x4}, @time=@tick=0x5}, {0xff, 0x0, 0x0, 0x0, @time={0x7, 0x7}, {0x4, 0x3}, {0x1}, @control={0x0, 0x0, 0x800}}, {0x0, 0x0, 0x0, 0x7, @time={0x4, 0x5}, {0x4}, {0x0, 0x4}, @raw32={[0xfffffffe, 0xffffffff, 0x5dc]}}, {0x0, 0xdc, 0x0, 0x0, @tick, {0x0, 0x3}, {0xa}, @quote={{0x1, 0xfe}}}, {0x0, 0x0, 0x0, 0x5, @time, {0x81}, {0x0, 0x49}, @ext={0x0, 0x0}}, {0x0, 0x1, 0x1, 0x0, @time={0x5}, {0x0, 0xf}, {}, @control={0xe8, 0x1000, 0x1ff}}], 0xc4) read$snapshot(r7, 0x0, 0xffffffbf) read$char_usb(r7, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x7fa1, 0x10, 0x101, 0x47a4cfe4, {{0x1e, 0x4, 0x1, 0xc, 0x78, 0x64, 0x0, 0x7, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x38}, {[@generic={0x7, 0x10, "f15380fa99554d4b118def7b5c39"}, @timestamp_addr={0x44, 0x54, 0x9e, 0x1, 0x2, [{@multicast1, 0x2b}, {@multicast1, 0xa0}, {@remote, 0xfffffffa}, {@private=0xa010101, 0x3}, {@multicast1, 0x8}, {@rand_addr=0x640100ff, 0x3}, {@multicast2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@broadcast, 0xfffffffa}, {@local}]}]}}}}}) sendmmsg(r1, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-syz_init_net_socket$llc-connect$llc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_open_dev$sg-ioctl$SG_IO-fcntl$dupfd-write$sndseq-syz_usb_connect-syz_usb_control_io-write$sndseq-read$snapshot-read$char_usb-ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL-sendmmsg detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r1, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='contention_begin\x00', r2}, 0x18) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x3c, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x40088) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r6, 0x2285, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) write$sndseq(r7, &(0x7f0000000180)=[{0x0, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}, {0x0, 0x0, 0x0, 0x0, @time={0x367f, 0xfffffffd}, {}, {0x80}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) r8 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000b529708410e42416ed401020301090224000100000000090400020221f7680009050100000401ff0709050210", @ANYBLOB="11a74b79"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) write$sndseq(r7, &(0x7f0000000200)=[{0x0, 0x2, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x9, 0x13, 0x29, @time={0x401, 0x5}, {0x4, 0x81}, {0x0, 0x4}, @time=@tick=0x5}, {0xff, 0x0, 0x0, 0x0, @time={0x7, 0x7}, {0x4, 0x3}, {0x1}, @control={0x0, 0x0, 0x800}}, {0x0, 0x0, 0x0, 0x7, @time={0x4, 0x5}, {0x4}, {0x0, 0x4}, @raw32={[0xfffffffe, 0xffffffff, 0x5dc]}}, {0x0, 0xdc, 0x0, 0x0, @tick, {0x0, 0x3}, {0xa}, @quote={{0x1, 0xfe}}}, {0x0, 0x0, 0x0, 0x5, @time, {0x81}, {0x0, 0x49}, @ext={0x0, 0x0}}, {0x0, 0x1, 0x1, 0x0, @time={0x5}, {0x0, 0xf}, {}, @control={0xe8, 0x1000, 0x1ff}}], 0xc4) read$snapshot(r7, 0x0, 0xffffffbf) read$char_usb(r7, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x7fa1, 0x10, 0x101, 0x47a4cfe4, {{0x1e, 0x4, 0x1, 0xc, 0x78, 0x64, 0x0, 0x7, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x38}, {[@generic={0x7, 0x10, "f15380fa99554d4b118def7b5c39"}, @timestamp_addr={0x44, 0x54, 0x9e, 0x1, 0x2, [{@multicast1, 0x2b}, {@multicast1, 0xa0}, {@remote, 0xfffffffa}, {@private=0xa010101, 0x3}, {@multicast1, 0x8}, {@rand_addr=0x640100ff, 0x3}, {@multicast2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@broadcast, 0xfffffffa}, {@local}]}]}}}}}) sendmmsg(r1, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix-connect$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r8, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix-connect$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r8, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) program crashed: BUG: Bad page state in z_erofs_do_read_page single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_disconnect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r4) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) socket$inet6(0x10, 0x3, 0x0) r2 = userfaultfd(0x80001) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r2 = userfaultfd(0x80001) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-write$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000080000000000000009000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085003fced62ec219af5d8697", @ANYRES32=r0, @ANYBLOB="0000000000000000180000000200000000000000800000000753ff0fb40d000018480000feffffff000000000000000018270000", @ANYRES32=r0, @ANYBLOB="0000000002000000183400000400000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r2 = userfaultfd(0x80001) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_mount_image$erofs-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(0xffffffffffffffff, r0, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r2 = userfaultfd(0x80001) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(0xffffffffffffffff, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r6, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100039f984640110f4020ec2a010203010902240001930b200409043202025d4d592009058f0300048102f90905821008000405ee0755e7a73a463b9dcfa710b040a2b7652aee85e314c4ceacdd29edfff54fb8408c69b42c2cf6ac5e4f333caa19942c4de08c8bebb27098cb13bb24afdc217450c96a40d832b10fad6718b8b4f255f369ddb0e3709a6507c828c6fd763e3f6e4dfd1ea97af0525c27339df24a55b507317e6bb42e957b3a79b9f3bf99130843efda15db9a2ad02dea73d50e27bf3671d4a38273"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x2002, 0x0) write$proc_mixer(r1, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAIN \'Capture Volume\' 00000000000000000000\nVOLUME\nLINE\nMONITOR\nCD \'CD Capture\' 8'], 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x800, 0x0, 0x0) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000), 0x0, 0x800, 0x0, 0x0) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(0x0, 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, 0x0, 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000440), 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-openat$proc_mixer-write$proc_mixer-openat$proc_mixer-dup3-socket$inet6-sendto$inet6-userfaultfd-syz_open_dev$evdev-syz_usb_connect-ioctl$EVIOCRMFF-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-madvise-fadvise64-socket$inet6-openat$ptmx-ioctl$TIOCSETD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socket$inet6-mmap-socketpair$unix detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x3008003, &(0x7f0000002ac0)=ANY=[], 0x2, 0x200, &(0x7f00000002c0)="$eJzsmbFrFEEUxr+Z3ds7gwRtLGwsDBjR7O3uqaSJEMFSEKKo5WHWEN3k5LJC7kDwsLHRzkKwtbG0sLCy8C+w1UIFwcIrBQthZGZnd4e93fMOTwXzfpDJN/PezLz3YF6xB4Ig9iyfPn778PDc8qWTAPZjAXW9/sXKfbjh//7JnROPV84/ffHu2Zvt+buviucxAEJUXve9aHIAvF61EIPZyYoQmM/tC0YIWuMyOI5rfQUMbiJ/CEUyCcFwTfvcNHRnnxZR6F7vROs3NqPQk4Mvh0AOLTM+GdRwwLAOoKGiE4IZ9p1e/1Y7isJuUdREes+IaVrBK8up41vlWEFaPSGk/9UH9wdyrmsDDzyrnw8OX+sWGNa0XkYdruvmJTHyP2zn51uT5D9jcVbd9WjSXc+VOLj05wNLRPpGptkly/g3SvcfidpMzmHFFfmgs5VDw7QHmj6f/1nu+LVPY/xjhLaPmN7ORdGF34jQKSlUJvL+JDv7MaM/2bCz/tGMt243d3r9pc2t9ka4EW4HQeuMd8rzTgdN1YiScUz/a6j+NGecX6vwdZiD3XYcd/1dIO762TxIxjwBrL3sfJVbDkD1P47Fo+oI1VNV2vXyO5j+4+q/VItWuee9ypwIgiAIgiAIgiAIgiAIgiDKOQKG5JcwwfQH0TKCi+oL5c8AAAD//40vYXw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r1, 0x0, 0x86) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = userfaultfd(0x80001) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000180)=0x1e) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) fadvise64(r0, 0xe0ffff, 0x19, 0x3) socket$inet6(0xa, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000180)=0x3) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, r7, 0xc541c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) program crashed: BUG: Bad page state in z_erofs_do_read_page validation run: crashed=true reproducing took 7h38m25.043466585s repro crashed as (corrupted=false): BUG: Bad page state in process syz-executor pfn:20c87 page:ffffea00008321c0 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x2 pfn:0x20c87 aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222623211, free_ts 403206314296 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010 BUG: Bad page state in process syz-executor pfn:7b56a page:ffffea0001ed5a80 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x3 pfn:0x7b56a aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000003 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222642281, free_ts 403206301183 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010 BUG: Bad page state in process syz-executor pfn:5f9c1 page:ffffea00017e7040 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x4 pfn:0x5f9c1 aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222660759, free_ts 403206287667 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010 final repro crashed as (corrupted=false): BUG: Bad page state in process syz-executor pfn:20c87 page:ffffea00008321c0 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x2 pfn:0x20c87 aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222623211, free_ts 403206314296 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010 BUG: Bad page state in process syz-executor pfn:7b56a page:ffffea0001ed5a80 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x3 pfn:0x7b56a aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000003 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222642281, free_ts 403206301183 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010 BUG: Bad page state in process syz-executor pfn:5f9c1 page:ffffea00017e7040 refcount:0 mapcount:0 mapping:ffff888074734290 index:0x4 pfn:0x5f9c1 aops:z_erofs_cache_aops ino:0 flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000001 dead000000000100 dead000000000122 ffff888074734290 raw: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192840(GFP_NOWAIT|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8104, tgid 8100 (syz.2.703), ts 403222660759, free_ts 403206287667 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 z_erofs_bind_cache fs/erofs/zdata.c:605 [inline] z_erofs_pcluster_begin fs/erofs/zdata.c:889 [inline] z_erofs_do_read_page+0x20c0/0x3680 fs/erofs/zdata.c:1024 z_erofs_pcluster_readmore+0x2cf/0x450 fs/erofs/zdata.c:1833 z_erofs_read_folio+0x208/0x540 fs/erofs/zdata.c:1853 filemap_read_folio+0x167/0x760 mm/filemap.c:2420 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3804 erofs_bread+0x16f/0x630 fs/erofs/data.c:48 erofs_find_target_block fs/erofs/namei.c:103 [inline] erofs_namei+0x28c/0xf00 fs/erofs/namei.c:177 erofs_lookup+0x135/0x310 fs/erofs/namei.c:206 __lookup_slow+0x281/0x3b0 fs/namei.c:1702 lookup_slow+0x53/0x70 fs/namei.c:1719 walk_component fs/namei.c:2010 [inline] link_path_walk+0x970/0xe00 fs/namei.c:2337 path_openat+0x283/0x3190 fs/namei.c:3793 do_filp_open+0x1c5/0x3d0 fs/namei.c:3824 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 vfree+0x1a6/0x320 mm/vmalloc.c:2868 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:2788 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: CPU: 1 PID: 5936 Comm: syz-executor Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 bad_page+0x14b/0x170 mm/page_alloc.c:512 free_page_is_bad mm/page_alloc.c:961 [inline] free_pages_prepare mm/page_alloc.c:1146 [inline] free_unref_page_prepare+0x887/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 detach_page_private include/linux/pagemap.h:539 [inline] erofs_try_to_free_all_cached_pages+0x295/0x600 fs/erofs/zdata.c:657 erofs_try_to_release_workgroup fs/erofs/utils.c:132 [inline] erofs_shrink_workstation+0x118/0x290 fs/erofs/utils.c:161 erofs_shrinker_unregister+0x5d/0x170 fs/erofs/utils.c:198 erofs_put_super+0x4e/0x150 fs/erofs/super.c:812 generic_shutdown_super+0x134/0x2b0 fs/super.c:693 kill_block_super+0x44/0x90 fs/super.c:1660 erofs_kill_sb+0x4c/0x140 fs/erofs/super.c:794 deactivate_locked_super+0x97/0x100 fs/super.c:481 cleanup_mnt+0x429/0x4c0 fs/namespace.c:1259 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2af990a77 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe3172ee88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fb2afa13d7d RCX: 00007fb2af990a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3172ef40 RBP: 00007ffe3172ef40 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3172ffd0 R13: 00007fb2afa13d7d R14: 0000000000062802 R15: 00007ffe31730010