Extracting prog: 1h16m19.413742786s
Minimizing prog: 26m7.026512651s
Simplifying prog options: 0s
Extracting C: 2m9.812834266s
Simplifying C: 11m1.758387444s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$video4linux-syz_emit_vhci
detailed listing:
executing program 0:
syz_open_dev$video4linux(&(0x7f0000000040), 0xffffffffffffffff, 0x2c00)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e07032d0c"], 0xa)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-socket$nl_generic-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-mlock-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_VCPU_EVENTS-madvise
detailed listing:
executing program 0:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x14cf, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat-mount-mkdirat-mount-openat-mkdirat-mount-openat-write
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r0, &(0x7f00000007c0)='active', 0x6)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-syz_usb_connect$midi-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-mmap$binder-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 12, 4, 3, 7, 4, 8, 3, 4, 12, 8, 14, 2, 17, 1, 8, 7, 4, 8, 4, 5, 4, 2, 2, 2, 7, 10, 7, 10, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000340)={0x6a, 0x3, 0x4, {0x1, @vbi={0x10000, 0x3800000, 0x9, 0x32435750, [0x0, 0x4], [0x1, 0x6], 0x1}}, 0x88})
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800)
sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x34, 0x64, 0xf31, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x4000004)
r5 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000001c0)={&(0x7f0000000940)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r4}}, 0x24}}, 0x0)
executing program 0:
unshare(0x6a040000)
syz_usb_disconnect(0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f00000000c0)={'filter\x00', 0x0, 0x0, 0x0, [0xd19, 0x1, 0x0, 0xfffffffffffffff8, 0x1000007ff, 0x4400000000009]}, &(0x7f0000000080)=0x78)
executing program 1:
r0 = socket$phonet_pipe(0x23, 0x5, 0x2)
connect$phonet_pipe(r0, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10)
writev(r0, &(0x7f0000002700)=[{&(0x7f0000000100)="9e705eb8439051bad0bdf8bf8705874beae838bc5fd20e0d35f3561b8b6c4b2b69532744fda233b2dee448b5df65a3c6995b5593c980aa4faf6ac1d14d6136323f12b5e53c10c1", 0x47}], 0x1)
executing program 1:
r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
connect$llc(r1, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @remote}, 0x10)
bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10)
setns(0xc9, 0x0)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/llc/socket\x00')
read$proc_mixer(r2, &(0x7f0000001640)=""/205, 0xcd)
executing program 4:
r0 = socket$netlink(0x10, 0x3, 0xc)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, 0x0, 0x0)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0)
executing program 4:
syz_kvm_add_vcpu$x86(0x0, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94)
io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
syz_emit_ethernet(0x5c, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x4e, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @local}, {0x7530, 0x7530, 0x3a, 0x0, @opaque="fa00"/50}}}}}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)="2a002e2f202031343734383336342320010000000000009fb4c31fe6f700203020300a", 0x23)
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
ioperm(0x0, 0x2, 0x2)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000080)=[0x0], &(0x7f0000000280)=[0x5ea4c147], 0x1})
r1 = socket(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r2, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80)
sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0)
getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0))
sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0)
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/cluster/mycluster/node/node0/local\x00', 0x1, 0xa)
write(r0, &(0x7f00000005c0)="00dfa0e2", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x933, 0x0)
executing program 2:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@multicast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x19}}, @time_exceeded={0x5, 0xea452954ff7d0934, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0xd, 0x6, 0x1, @dev={0xac, 0x14, 0x14, 0x9a}, @remote}, "001863714ab99043"}}}}}, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0)
ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x8fb, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xff7fdff9, 0x2d7b, 0x401, 0x0, 0x3, 0xfffffffe, 0x3, 0xf012, 0xd2, 0x80000002], 0x1, 0x4000003})
executing program 2:
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6014d71800140600fe8000000000000000000000000000aafe80000d"], 0x0)
executing program 1:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000600)='\x00\x00\x00', 0x3)
close(r0)
executing program 3:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r0, &(0x7f00000007c0)='active', 0x6)
executing program 2:
mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$l2tp(0x2, 0x2, 0x73)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000840)=0x473e, 0x4)
bind$l2tp(r0, &(0x7f00000000c0), 0x10)
sendto$l2tp(r0, &(0x7f0000000280)="e5786a0d000000000000003b", 0xc, 0x8000, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10)
recvmsg(r0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x23, 0x0, 0xffffffffffffff22}, 0x40002020)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x14cf, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000040), 0xffffffffffffffff, 0x2c00)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e07032d0c"], 0xa)

program crashed: general protection fault in dummy_udc_start
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <30>
bisect: split chunk #0 of len 30 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 17, 1, 8, 7, 4, 8, 4, 5, 4, 2, 2, 2, 7, 10, 7, 10, 2]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/cluster/mycluster/node/node0/local\x00', 0x1, 0xa)
write(r0, &(0x7f00000005c0)="00dfa0e2", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x933, 0x0)
executing program 2:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@multicast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x19}}, @time_exceeded={0x5, 0xea452954ff7d0934, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0xd, 0x6, 0x1, @dev={0xac, 0x14, 0x14, 0x9a}, @remote}, "001863714ab99043"}}}}}, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0)
ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x8fb, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xff7fdff9, 0x2d7b, 0x401, 0x0, 0x3, 0xfffffffe, 0x3, 0xf012, 0xd2, 0x80000002], 0x1, 0x4000003})
executing program 2:
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6014d71800140600fe8000000000000000000000000000aafe80000d"], 0x0)
executing program 1:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000600)='\x00\x00\x00', 0x3)
close(r0)
executing program 3:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r0, &(0x7f00000007c0)='active', 0x6)
executing program 2:
mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$l2tp(0x2, 0x2, 0x73)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000840)=0x473e, 0x4)
bind$l2tp(r0, &(0x7f00000000c0), 0x10)
sendto$l2tp(r0, &(0x7f0000000280)="e5786a0d000000000000003b", 0xc, 0x8000, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10)
recvmsg(r0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x23, 0x0, 0xffffffffffffff22}, 0x40002020)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x14cf, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000040), 0xffffffffffffffff, 0x2c00)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e07032d0c"], 0xa)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 4, 2, 2, 2, 7, 10, 7, 10, 2]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/cluster/mycluster/node/node0/local\x00', 0x1, 0xa)
write(r0, &(0x7f00000005c0)="00dfa0e2", 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x933, 0x0)
executing program 2:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@multicast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x19}}, @time_exceeded={0x5, 0xea452954ff7d0934, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0xd, 0x6, 0x1, @dev={0xac, 0x14, 0x14, 0x9a}, @remote}, "001863714ab99043"}}}}}, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0)
ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x8fb, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xff7fdff9, 0x2d7b, 0x401, 0x0, 0x3, 0xfffffffe, 0x3, 0xf012, 0xd2, 0x80000002], 0x1, 0x4000003})
executing program 2:
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6014d71800140600fe8000000000000000000000000000aafe80000d"], 0x0)
executing program 1:
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='dev_mnt\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000600)='\x00\x00\x00', 0x3)
close(r0)
executing program 3:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r0, &(0x7f00000007c0)='active', 0x6)
executing program 2:
mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$l2tp(0x2, 0x2, 0x73)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000840)=0x473e, 0x4)
bind$l2tp(r0, &(0x7f00000000c0), 0x10)
sendto$l2tp(r0, &(0x7f0000000280)="e5786a0d000000000000003b", 0xc, 0x8000, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10)
recvmsg(r0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x23, 0x0, 0xffffffffffffff22}, 0x40002020)
executing program 1:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
io_uring_setup(0x14cf, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0})
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000040), 0xffffffffffffffff, 0x2c00)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e07032d0c"], 0xa)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 17, 1, 8, 7, 4, 8, 4]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 4, 8, 4]
detailed listing:
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 17, 1]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)

program did not crash
bisect: split chunks (needed=true): <5>, <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 1, 8, 7, 4, 8, 4]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 8, 7, 4, 8, 4]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)

program did not crash
bisect: split chunk #1 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 17, 1, 8, 4]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140))
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x400000b0, 0x0, 0x101}, {0x400000b1, 0x0, 0x7}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000084, 0x0, 0x39}]})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r0, 0x929, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 2, 17, 1, 8, 7, 4]
detailed listing:
executing program 4:
write(0xffffffffffffffff, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='0', 0x1)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x90})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x3})
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, 0x4000, 0x2})
executing program 4:
timer_create(0x2, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000400"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x10, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
getpgid(0x0)
r1 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0)
ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802c53b418126a7aed1c00000000000e7ffffffffdeffff0000df00", 0x3, 0x7ffffff8, 0x4, 0xb700, 0x4050805, 0x8})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0)
ioctl(r2, 0x8b32, &(0x7f0000000040))
syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0)
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>, <2>, <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 1, 8, 7, 4]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 1, 8, 7, 4]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 3:
syz_emit_ethernet(0x3e, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2686dd60011c4e"], 0x0)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 8, 7, 4]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: split chunk #2 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 4]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 8, 7]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000002800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040c0)
bpf$TOKEN_CREATE(0x24, 0x0, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
bisect: split chunks (needed=true): <1>, <1>, <2>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17, 7, 4]
detailed listing:
executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #3 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunks (needed=true): <1, final>, <1, final>, <1>, <1, final>
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 4 programs left: 

executing program 1:
r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
ioctl$HIDIOCGFEATURE(r0, 0x4004480d, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)


bisect: trying to concatenate
bisect: concatenate 4 entries
minimizing program #0 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 17, 7, 4]
detailed listing:
executing program 0:
syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 7, 4]
detailed listing:
executing program 0:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
minimized 2 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r4, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002040)={0x8, 0x0, &(0x7f0000000d80)=[@acquire], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r3, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r3, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r3, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r2, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r2, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r2, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0xf8efc6028ed0514d})
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 7, 4]
detailed listing:
executing program 1:
executing program 0:
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program did not crash
minimized 17 calls -> 4 calls
minimizing program #2 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 6, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 5, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x7})
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 4, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@rdmsr={0x66, 0x18, {0x900}}], 0x18})
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 3, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 2, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 1, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0, 4]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 0:
executing program 4:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, ' \x00\x00'}}, 0x9)

program crashed: general protection fault in dummy_udc_start
minimized 7 calls -> 0 calls
minimizing program #3 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0, 3]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0, 2]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0, 2]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
executing program 0:
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0, 1]
detailed listing:
executing program 1:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
executing program 3:
executing program 0:
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program crashed: general protection fault in dummy_udc_start
minimized 4 calls -> 1 calls
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program crashed: general protection fault in set_link_state
bisect: concatenation succeeded
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0), 0x0)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, 0x0, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0)

program crashed: general protection fault in set_link_state
extracting C reproducer
testing compiled C program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in set_link_state
simplifying C reproducer
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
program crashed: general protection fault in dummy_udc_start
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0)

program crashed: general protection fault in dummy_udc_start
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0)

program crashed: general protection fault in dummy_udc_start
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect$midi
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000008c0)='dummy_hcd.0', 0xb)
syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0)

program crashed: general protection fault in dummy_udc_start
validation run: crashed=true
reproducing took 1h59m42.265994964s
repro crashed as (corrupted=false):
dummy_hcd dummy_hcd.0: remove, state 4
usb usb1: USB disconnect, device number 1
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 1 deregistered
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 4321 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:dummy_udc_start+0xb7/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1018
Code: 00 00 ff 24 c5 80 42 d5 8a e8 c5 6f 42 fb eb 13 e8 be 6f 42 fb eb 0c e8 b7 6f 42 fb eb 05 e8 b0 6f 42 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 da 93 87 fb 4d 8b 36 4c 89 f7 e8
RSP: 0018:ffffc90002f7fb20 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807d1ec050 RCX: ffff8880261f8000
RDX: 0000000000000000 RSI: ffffffff8ced7e00 RDI: 0000000000000003
RBP: ffffffff86368d30 R08: ffff8880261f8000 R09: 0000000000000004
R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
FS:  000055558cb99500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7114986240 CR3: 000000001ead1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_gadget_udc_start drivers/usb/gadget/udc/core.c:1150 [inline]
 udc_bind_to_driver+0x2b5/0x5f0 drivers/usb/gadget/udc/core.c:1577
 usb_gadget_probe_driver+0x1fb/0x380 drivers/usb/gadget/udc/core.c:1637
 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:549 [inline]
 raw_ioctl+0x115e/0x3750 drivers/usb/gadget/legacy/raw_gadget.c:1256
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f711499cd6b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffe916edf70 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f711499cd6b
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004
RBP: 00007ffe916ef040 R08: 0000000000000001 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000200000000480 R14: 0000000000000005 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace f5da39a91c4dccad ]---
RIP: 0010:dummy_udc_start+0xb7/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1018
Code: 00 00 ff 24 c5 80 42 d5 8a e8 c5 6f 42 fb eb 13 e8 be 6f 42 fb eb 0c e8 b7 6f 42 fb eb 05 e8 b0 6f 42 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 da 93 87 fb 4d 8b 36 4c 89 f7 e8
RSP: 0018:ffffc90002f7fb20 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807d1ec050 RCX: ffff8880261f8000
RDX: 0000000000000000 RSI: ffffffff8ced7e00 RDI: 0000000000000003
RBP: ffffffff86368d30 R08: ffff8880261f8000 R09: 0000000000000004
R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
FS:  000055558cb99500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7114986240 CR3: 000000001ead1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	ff 24 c5 80 42 d5 8a 	jmp    *-0x752abd80(,%rax,8)
   9:	e8 c5 6f 42 fb       	call   0xfb426fd3
   e:	eb 13                	jmp    0x23
  10:	e8 be 6f 42 fb       	call   0xfb426fd3
  15:	eb 0c                	jmp    0x23
  17:	e8 b7 6f 42 fb       	call   0xfb426fd3
  1c:	eb 05                	jmp    0x23
  1e:	e8 b0 6f 42 fb       	call   0xfb426fd3
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 da 93 87 fb       	call   0xfb879413
  39:	4d 8b 36             	mov    (%r14),%r14
  3c:	4c 89 f7             	mov    %r14,%rdi
  3f:	e8                   	.byte 0xe8

final repro crashed as (corrupted=false):
dummy_hcd dummy_hcd.0: remove, state 4
usb usb1: USB disconnect, device number 1
dummy_hcd dummy_hcd.0: stopped
dummy_hcd dummy_hcd.0: USB bus 1 deregistered
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 4321 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:dummy_udc_start+0xb7/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1018
Code: 00 00 ff 24 c5 80 42 d5 8a e8 c5 6f 42 fb eb 13 e8 be 6f 42 fb eb 0c e8 b7 6f 42 fb eb 05 e8 b0 6f 42 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 da 93 87 fb 4d 8b 36 4c 89 f7 e8
RSP: 0018:ffffc90002f7fb20 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807d1ec050 RCX: ffff8880261f8000
RDX: 0000000000000000 RSI: ffffffff8ced7e00 RDI: 0000000000000003
RBP: ffffffff86368d30 R08: ffff8880261f8000 R09: 0000000000000004
R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
FS:  000055558cb99500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7114986240 CR3: 000000001ead1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_gadget_udc_start drivers/usb/gadget/udc/core.c:1150 [inline]
 udc_bind_to_driver+0x2b5/0x5f0 drivers/usb/gadget/udc/core.c:1577
 usb_gadget_probe_driver+0x1fb/0x380 drivers/usb/gadget/udc/core.c:1637
 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:549 [inline]
 raw_ioctl+0x115e/0x3750 drivers/usb/gadget/legacy/raw_gadget.c:1256
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f711499cd6b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffe916edf70 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f711499cd6b
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004
RBP: 00007ffe916ef040 R08: 0000000000000001 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000200000000480 R14: 0000000000000005 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace f5da39a91c4dccad ]---
RIP: 0010:dummy_udc_start+0xb7/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1018
Code: 00 00 ff 24 c5 80 42 d5 8a e8 c5 6f 42 fb eb 13 e8 be 6f 42 fb eb 0c e8 b7 6f 42 fb eb 05 e8 b0 6f 42 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 da 93 87 fb 4d 8b 36 4c 89 f7 e8
RSP: 0018:ffffc90002f7fb20 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807d1ec050 RCX: ffff8880261f8000
RDX: 0000000000000000 RSI: ffffffff8ced7e00 RDI: 0000000000000003
RBP: ffffffff86368d30 R08: ffff8880261f8000 R09: 0000000000000004
R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
FS:  000055558cb99500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7114986240 CR3: 000000001ead1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	ff 24 c5 80 42 d5 8a 	jmp    *-0x752abd80(,%rax,8)
   9:	e8 c5 6f 42 fb       	call   0xfb426fd3
   e:	eb 13                	jmp    0x23
  10:	e8 be 6f 42 fb       	call   0xfb426fd3
  15:	eb 0c                	jmp    0x23
  17:	e8 b7 6f 42 fb       	call   0xfb426fd3
  1c:	eb 05                	jmp    0x23
  1e:	e8 b0 6f 42 fb       	call   0xfb426fd3
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 da 93 87 fb       	call   0xfb879413
  39:	4d 8b 36             	mov    (%r14),%r14
  3c:	4c 89 f7             	mov    %r14,%rdi
  3f:	e8                   	.byte 0xe8