Extracting prog: 8m55.793024589s Minimizing prog: 48m0.803282599s Simplifying prog options: 0s Extracting C: 26.38568988s Simplifying C: 5m13.819715159s 30 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-sendto$packet-madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise-madvise detailed listing: executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-syz_usb_connect detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x5df, &(0x7f0000000300)=ANY=[@ANYBLOB="1201100111f625408d0405903d40010203010902cd0501a47a20090904"], 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r2}, 0x10) r3 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x40, 0x19, 0x2, "b3f0"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000300)={0x2c, &(0x7f0000000180)={0x0, 0x0, 0x1, '\\'}, &(0x7f00000001c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_SECUREBITS-socket$inet_udplite-getsockopt$sock_cred-setreuid-openat$vcsa detailed listing: executing program 0: prctl$PR_SET_SECUREBITS(0x1c, 0x1e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r1) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 15s testing program (duration=22s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 3, 5, 8, 8, 3, 5, 3, 7, 6, 1, 6, 6, 14, 12, 5, 7, 17, 17, 21, 4, 24, 17, 9, 9, 13, 2, 7, 14] detailed listing: executing program 2: bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x6, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff71a4f0ff000000002d040000000000003d400300000000006504000001ed000079110000000000006c440000000000007a0ab0fe000000007b13000000000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e655400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ec43e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c4378c9b71dff64075b74a6520adb187b40d2cccbcb08c0634ee74658d3e23bf511c8b0bf1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b0613bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f3b225ec4e09b089f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b2a0c4b81f7b71cbfcef"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) executing program 4: r0 = creat(&(0x7f0000000340)='./file0\x00', 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) executing program 4: socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000180)={0x0, 0x1, 0x6, @dev}, 0x10) executing program 0: unshare(0x22020600) socket(0x840000000002, 0x3, 0xff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000580)="838f5edb1dbf110d658ad97e31", 0xd}, {&(0x7f0000001340)="f0d4e6ebd2c8886b7f5a4eda16b132f0c8187d37ab6e76f8c8b40c51702a591baed12e425f335fe287eb5bfd1bcdbbe6118b70f560e33a01516f38091635862cb7fdc6713f503005e6170e3cc84b1eee672c232f920916efe8c3da11b9900eb28f0ce42ffc3d115f42f0eae3ec5a6d7c61cb4c8d97251d549063c85b40ce743c0eb192c4e5ddcb3c6686942310ce6744b62b66f11c0c124024733b5f7446d0101e8e6edf073368e541886ad02399af0dce5f0585a6056d93ff331e103d7ac448839b85a98e7f529e7775c3db6f6035d7c4ea77cef00ab1387f81b52584a4b861bcc17965f909a757f0a2e7c79375276c9acf3912a5a5b87dc58300f32b6bd66deaf9c15ec4f6bd7cfc47c3337a8f737b4b2feac97209aa478fb96ce5d77d30cba63981354f6a6ae4bd63f14a0906cfcdc9583008ea2ce196f8fb524ee45272ffa592b3782d156c6a907eceb7b23bfe92723ea868feab4b56d81886058d58ad1caa5849b27e76e825283bac95d4f1f732f973318fdba54a49a54770134e71bd906df8d8527dc6caf3d720f4a7a9e1b671565b1e56a8cc4e6ae44670929079b293564471f2010c6678af3afb09b60ec6e5faf6fd567fda6d965056854bf8fc9513735b57da9ddb6114647e334d254c038b04833f69bc82fa9d7b3606520b14f2d4d4ae2be0aa28c74a2acef2582b1e085c3af7978c60767fd214019bd2fde07cf1e1d57ef23c3dc1dba0345e84a77c5614110a4cf5b71c952c1be1335d868fe788433e26711c20080bca711f6edba6739a679983daa4734cd39c4d304fc48dc97f5d1757fa738d866b3f24040d19b360f68e036dd0373e23d2f56afdffa32175ef6758297b318716cbb027f29cb6bf4975342790f521f56eb0d9358c1dc02e0ca50428b590c33b88d13401458be10a57ce1cdded3835b8c81b6310290adc2f0e6d6e1ccd5ea6d9d23482f38239ddaf671ac07a7404fc18fb4f3b8a4cb49ac5c055f2de25f993913ab0863b3971a66579f6dec0e8ee00bb2ff2782dd9731c9988113c9748254687be60230f5a16217259a9ff3b9f47edbc69ebbe652d669ffb2e26eba8d79ebfc85cc15b7ed1bf6bacee4b51e65b24f7aad0c10ebe449bff6cc4d9b096b4da750aba0ca1dfbca2bdbc67ac73bb0c177cce59878d7f96a4139308305be1fe7ce44ccb3d768315c4c5ebf9644e9729fda02c0a4bee40182f79ef214af0506232c7f5bb201ab89d788e169dc11e51229c84dbcfa6851d0dca1ae68bf0afb65de0608cd92c13cb7f96238ffcd5fe3430a0bda4d280cd874f29de5409fc61cf551a4ea222589a31c8dc46dbc280ab1784cc09f22faa4d08f80f918bcb1173092cf27ae43d248ae81f21a592f7bac9236d019fdedadff7f74e88e363f6e6eeb71266b5caaf07126cd48355d20bde6d5bedf1f295f1a3a694a2ea8fd405afed712ea15453351826b96fe47466e1281de8fe57792d5eac17e0cac9bb01", 0x41e}], 0x2}}], 0x1, 0x0) sendto$inet(r0, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000040)='./file0/../file0\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x297880, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x201c448, &(0x7f0000000080)=ANY=[@ANYBLOB='map=acorn,utf8,session=0x0000000000000004,session=0x0000000000000056,map=normal,session=0x000000000000003d,unhide,norock,block=0x0000000000000400,map=off,session=0x0000000000000001,uid=', @ANYRESDEC=0x0, @ANYBLOB=',gid=', @ANYRESDEC=0x0, @ANYRESOCT=0x0], 0x1, 0xa78, &(0x7f0000000fc0)="$eJzs3c1vHGf9APDvbGzHdqs2bfNr+4vaZpIqrdsGZ23TRFEPNLHXyRa/INuRGgnUVI2DolgUNSC1EVJTCXGiokIICZAQ6pFTpXKgF5QTcOTEAQn6H6CKU4qAQTO7a+86+5K4azstn0+03pl5vs/bzOw88Xp3nuDzLMuy4rHF9XO/3snGcvc5PfPx+x+8mz/euR5DsSeeT34bMRwRacTAv4tzZXB6ZmlxvkdBVyIuRMSNiCQi9kbtuYORlrULkfwo7t1YvxHJL+LRNtmG77Bz9JTxP223zz8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgrTc+UyxNJzFUXzr2cdlZMAd4lvVHcR8Ws38lHvapNIpL8EcPDjam+H92/kfxw/uNwPFZbe6w28/dwXLvn4X0vPDRQauTv0qAdcfWta1deXVtbfaO+vjdNB3tm2rvtzbpzQ1vLdqayUF1erM6fOlNJq8uL6cnjx8vHzs4up7PVqCyfX16pzKfTS5VTK4tL6dj0M+nEyZNTaWX8/OK5hTMz43OVxsYTX5osl4+nL41/rXJqaXlx4dhL48vTZ6tzc9WFM0VMnpzHnMhPxK9WV9KVyqn5NL10eW11qlcj86CJtilJa9Bkr5Imy5OTExOTI3H8+ZPPnyiXB+obJicaG8qbxC0Ru3/S0m+/vO3I3/T9+g2fQak+/sdcVGMhzsXLkbb9Nx0zsRSLMd8mLdkorzH+HzlW6Vpv8/jfGOUf3Ug+EMX4/0Rt7YlO43+Htvb+l2W1kreav/HvarwV1+JKvBprsRar8cZnLjGN37euf7o5/V9Zlm2h3DTv7cHmfdCHtp6JSixENZZjMaoxH6eKLWl9Sxon43gcj3K8EmdjNpYjjdmoxlxUYjnOx3KsRKU4o6ZjKSppxEosxlKkMRbT8UykMREnYySmIo1KjMf5WIxzsRBnYiZOFaVcisvFfp/q0sb1oInbCZrsEnTLYP7Zxv/sbvyfINutz1dw2LqsPv4PdQzIGktj0zvWKgAAAKCf/v+Pcd/+B//w14jBeLx4X362Olcp73azAAAAgD4qPq73WP40mEXE45G0+f2/tEuNAwAAAPoiKb5jl0TEaBysLdW+CbUnfAgAAAAAviCKv/8/kT+N5ksHI1m/E8qF3W4bAAAA0B+977HfMyIZjvo9LdOLteeL9Yj6fX5HZ6tzlfHpxbkXJuKp4i4DxTcNbiltT0QyWHz94Nk4VIs6NFp7Hm0tcTiPmhh/YSKejcP1jow9mT89OdYmcrIW+XQt8ukukVN5JAB80R2+dTz+NLvD8f/ZOFqLOHpgYCgiBg60GVnLGyPrwG50FABY13uOndaIt+v5msf/L2/8/j9YT24Z/x+MS//JN67GeLwWr8daXIyjxbcNik8ctNT79ffq7xmsfwyhHEd7vBvQiP3TiVIc7fF+wGjTRC9He7wjUIuNb0RMbe9BAIAddrjDONxp/C8iovHBwdr4f7Tp9/+49ff/9amFVn2lEADuCusz2Pd1IdvTvGW3+wgAtDJKAwAAAAAAAAAAAAAAAAAAAAAAAAAAQP/19bb/w1vM/rf6vH61LVn/5yNovzBS3weNLW/f0d545+pb134cEc1JpbwT29PmoqX9LbnUh3KyiNip47VzC7EvYst7NdolDUXEtjd+pB9VfFpfqL02St0uHue6pgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA5kETsabe9FLE3IsoRcWznW7V9ru92A3beV5pXkptxM96M+3avOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX0z1+/+XovZ8T21TDJQijkTEhYjIdruN/XRztxvQJyNbzNd0///8mEeWxEDtsEcyOD2ztDifH/5i7ofSx+9/8O4jrdn33m49RWBp0+QS9Ro2x/7q3sbSA0Wu0ZnVq1e+8/q305nTUYqhOL0yOzczf2bpxY0sDycfRqRRezTk7c0f3zvyu/fa9PzDvKftba53ttg5M7fW+0i73N3r7eby2upkXtNK5eWV737r8ptNSQ/GoYgnxyLGWmv6Zv7oUNOhGOxWW/JJ8oPkvvhpXCiOf743kizJD9H9Rf9HLl1eWx1/7fW1ix3atC8ORsTFiOGebVrf1QeL60lbxVlXGsxrLRdB+Y/9PfrYXvMcF7USJzr04YHilBmt92GopQ+lDnWmnftQ7PCm/V5qLCTJ5hZN1Vs0FK0teiieanOks70RnffCU92PdHvJJ8lfkrPx5/h+0/wfpfz4H4nOr87WIorIpjOlY2SpFln0fLI54ZXNkX//2W21vu00NdypH7a8eEtN1//6serT9ShLul6Pmmqc6lBj+9fFpho3nxWljh0vRqT9m3LUrz4dM9Xaub8W1aGd/xfPRQwc6HZVvGW0fq7zFaU1/4vtk7f6+v95Mhb/iOvm/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO5+ScSedttLEUciYl9jPY3I7qDYvZ0SSqPJnTaxr66v//ic21/8LLVse6d3tuRm3Mze3q5GAQAAAAAAALDTTs98/P4H7+aP4u/xe25mWf3v+2nEQETsS34yEjNLi/M9ChqMuBARN/Ll4U5B/8xqWrfm+eLejfUbEdn9W+8SANDDfwMAAP//zlFyiw==") executing program 4: syz_mount_image$squashfs(&(0x7f0000000180), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYRES16=0x0, @ANYRESDEC, @ANYRESHEX, @ANYRESDEC, @ANYRES8=0x0, @ANYRES64, @ANYBLOB="01ce6671a3b30f673148672100038bbb4413ea284b892438cdddda3da4c78d940655fbd68a286059c5766f98f85fb413503eaf8c90a24dda1e09f68cd741168d69dae50652ca7b67c5b0a27ab80ff9afa5000443de8c748e1d5beabee7c1346b215f641ae190d56ea4ab81bacd909929deb5757040e8d5b2752ea779c30f600bd516a68d881e7fc7289826d49e35134a94e27f115c8195a0f152cbd840ffdb008356c72319cceb43ccb1280556efdf0fdf582fd3cfc830dff1787f000000b7400f5aef57b6dcbfde7af6012383adb085c40e4c295c2a3be750a42400e58523d24b8eecd75caabcee22347bdb78b72b400d080a044ebde5d39ad91ff0ef75aa244381cf00cd6fe9b9a92a9968104bf02481022af426853287e521a4e3cfe480f984efcea1359ff932ebd3bc75aefea41074799f3502a7472a6686b4011a41d7f0cfb25b3dc3077b4e8ded17cfff2b1d59bc12f637c36690f5ca91ee999ec138f6ce66522e652939a37435edb78f9ae18489f9d2b73c81609399f0d123f1721171bd72c012623f04d8965d3e5785d057c15798ab36af821c9b308731422ba3858b9895ace14068ea58f8cb6060c205caf209a73628eff5b9270a4a55c2d7fc59a4fe6e023bd424d8b010e2232d1b2e6ca603b466b2c82afff4a8cc469e8664d54769fc97df122b3ff8c34354dad46f900eaf6e72e538c0595caa056984ab8974af7cdae5bde6a12f412fe2a876aa191e78e91fbf780e2f4a20f57d41376b29f990ce63aa6edf622d2203fee37df269abf869d13b175852b775fff70491d1e5d1311b7eef954a101ddb98c5ba2b312528485ece7aff23cc6fee599daea0fca71a5970cf0fc82b49640cc3fabbc401dead4f83aa0c4072a9e98ab5afb790be17961fc073e2f8f800000000000000005089d6db5ad893ee9b22b9250d01980952d0a3e0076c877556fa43f90cb574fd6ad67398ac4d9f8ff4e3ef09f99220928602523adc2289b51328ac152bd7edc66d4e962cbc2d2b0c5f8e48384eff563a10787b0199642385e811504e7168804114842d51f42dd6937515fa64b2fd14ef427072c6556b99171bd00165a9aada7173f001679ac791ee67188c670f583f7b1f8df68b97f4dcb5652f2b13aa941b7ff56c48fb7162e91ef53c70938a92e4bf55d65319f74766a309722f767fc8f3db2a194a2f098336601be2edcbcc9b562f2fc64e2deff9a16e84f1e8bc5fb82c91f4d10e34f5a093fc4fcbdb89342274857c8e6aa8864b3214f51b9e515bf645235007cede80ff5931bff340780a3b43bc0466340c195a515f779d0333dd467bb665508d9c89e18e86d1975e273f937e3bd1", @ANYRESDEC, @ANYRES32=0x0], 0x1, 0x1f6, &(0x7f0000000680)="$eJzslU1rE0EYx3+zO2kazaFnTwWD7UXbbEH8BvYD+AEM6VqLG1+6AU0oGL304kH8EgU/hQdB7x5EBC/1oKCHiqeKrMzOM9MNicRKeyjMH5bnZZ6XeZ7ZeeZ2/iCvA78PdrosUELR5KNSaGBJWd3hnKU/hBaCL9rKbdG/FPpZaD4Yvntm2eGdTpal2/lgBqMUzLLJCiwj6Rk30lOSOcuZod8+HdcophpHwD/VcyKMyTax1I9tSZNez8c09Wk24stpb74mef7LffEY/42t1DI/m+O/xNeTrqvGaZ97pWO/mn87piJ2/fnwwrbZL0nbMcaxuDcmbspZY6JjeeXI+MqvP4n4XgrvD3a6hrkpU8zoNuznrkRpY4TXFZsLGkagYgofR5fTEpaAlX7v/ko+GF7e6nU20830bpKsXV19c15OoXgMW1m6qirbMJcaN5cAc08blXVzdT4drY+oQMnWpEDOgXK8c3HDeflixbEBUaUsR4/ivvL566KL6XGDS8wDD0dqERJst1qYaJpbprR1FLEIbV3ZJxwSMV8uXOneyzZ2USjntof2Mdr71LyQiGASpWvXfPm7QltC14XuCd0X6t4u9ybpMsI3kZZHMMejTr+/XT5elvO6xOuSBZ85kqzuNXQNb9UJCAgICAgICDgj+BMAAP//duk56A==") r0 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) executing program 4: prctl$PR_SET_SECUREBITS(0x1c, 0x1e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r1) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x8, 0x0, 0x0}, 0x90) executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r0, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK/file0\x00'}, 0x6e) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, 0x0, 0x0) executing program 1: mq_open(&(0x7f0000000000)='!!:\'-){\x00', 0x0, 0x0, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) memfd_create(0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, 0x0, 0x0) executing program 0: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000ffff00b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000009500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) sendmsg$inet(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x40, 0x19, 0x2, "b3f0"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000300)={0x2c, &(0x7f0000000180)={0x0, 0x0, 0x1, '\\'}, &(0x7f00000001c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x4c, r0, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x4c}}, 0x0) executing program 1: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r0, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK/file0\x00'}, 0x6e) executing program 1: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@gettclass={0x24, 0x2a, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x4}}}, 0x24}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = gettid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400007200000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) getrusage(0x0, 0x0) epoll_pwait(0xffffffffffffffff, &(0x7f0000000040)=[{}], 0x1, 0x0, 0x0, 0x600000000000000) tkill(r2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) pipe(&(0x7f0000000180)) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010aedff7f000000000007000000"], 0x26}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="2003810000008101877016e046aa37f10133fbad2a65b1814a15761682b6a645e58800b2fb2e8ae4c5c373c4e69d5da02bfbca862dc6f6d3852326f4abdce861448fa07494322aa05498b7532c48d68dc1ad40a86df36ff42666c8712714e0624e7f6b6b930e09aa5ec8d37e7a7c49e064686834779f67cdbcd598af1d5fa8", @ANYRES8=0x0, @ANYRES64=r4], &(0x7f0000000c00)=ANY=[@ANYBLOB="0003b8000000b803f7e44986826636e5a71a6aa0c0ba137c49ffc2b6eda4b39955989b1c373e48b1467b41037d85f3c3ae88bcc60b8d987ac8371d76185dd3b338d05e7c30d03d826b2e85a2c1dd9ab17240915e8b01b41647453c842032c5231ded66f164c4d1ac3724d0d8212a6136b8eddc2f6fe7fb6ad295f9d513b2a0bd10faf4a6c5e5d52aa5fd5df0649ae820469fb9e35d8909f2292bf7d3f8a34c9d3e3de7785cb2ad6b1e87d33cdd8e60ab237c05899a47b54464774ca81675c09e306ffd4b6837bc3b094417ba83b8d66c8b64444816a2addf5e57780a5ee0d2f5bee718430d9ffa72bf70a7b2d8dda5f7f1aed15f6b60114e2562c6a3913646393ce063471bcd1f13fb1e4eb520f88583"], &(0x7f0000000380)={0x0, 0x22, 0x10, {[@global, @global=@item_012={0x2, 0x1, 0x18, "9d6a"}, @global=@item_012={0x0, 0x1, 0xa}, @local=@item_4={0x3, 0x2, 0x1, "70bb0297"}, @main=@item_012={0x2, 0x0, 0xa, "42bf"}, @local=@item_012={0x2, 0x2, 0x7, "ee52"}]}}, &(0x7f00000001c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x95c}}}}, &(0x7f00000007c0)={0x2c, &(0x7f00000004c0)=ANY=[@ANYBLOB="400f420000001913d20987ca3b5cd08d275592b8476e26679b166d47d116e2a1b5095e69232c03302ef80a420ba29c9dec532c11139bcbe938e989aad9180280cc6973b417168600"], &(0x7f0000000300)={0x0, 0xa, 0x1}, &(0x7f00000006c0)={0x0, 0x8, 0x1}, &(0x7f0000000700)={0x20, 0x1, 0x63, "0acf91c86440b7ce08ba0284b0c17fc46900068b35f7c3a5c19a41ba7a06102daccdfeeb6e8b3373ee01f7de8693a695e8df8f623bb97252f3e3070a4ff0737c51a058228d2d32cf8c6ab05a99ddeda8862eaf62895595efd6445aff223612fc3206bb"}, &(0x7f0000000780)={0x20, 0x3, 0x1}}) pipe(&(0x7f0000000980)={0xffffffffffffffff}) syz_clone3(&(0x7f00000009c0)={0x384000000, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x3b}, &(0x7f00000008c0)=""/59, 0x3b, &(0x7f0000000900)=""/51, &(0x7f0000000940)=[0x0, r2], 0x2, {r5}}, 0x58) executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair(0x0, 0x0, 0x0, 0x0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) inotify_init() recvmmsg(0xffffffffffffffff, &(0x7f0000001700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)='cubic\x00', 0x5) sendto$inet6(r2, &(0x7f0000000140)='i', 0xffffffc0, 0x49, 0x0, 0x0) flock(0xffffffffffffffff, 0x1) shmat(0x0, &(0x7f0000ffb000/0x3000)=nil, 0x0) executing program 3: getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}}, 0x40800) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB='\b\x00\r\x00', @ANYBLOB="1400e20000000000000000000000ffff640101", @ANYBLOB], 0x11c}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) syz_open_dev$mouse(0x0, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000480)) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) msgget(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x13) recvmmsg(r2, &(0x7f0000002080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000020, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x3a}, 0x0, 0x0, 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x3a, &(0x7f0000002380)={@local, @random="365c4cfb3e29", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data}}}}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@generic={0x89, 0x2}]}}, {0x0, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "955aec9ef39911c4e608778212119fd3c62597a2d165de62", "580c5119fb37bf4a8be03c1f77f40bafce6ab79eb3b71dc477351f542ce9232f"}}}}}}, 0x0) executing program 2: bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000200)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0xcf, &(0x7f0000000380)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f00000003c0), &(0x7f0000000400), 0x8, 0xe5, 0x8, 0x0, 0x0}}, 0x10) r0 = socket$inet(0x2, 0x4000000805, 0x0) listen(r0, 0x7) sendmmsg(r0, &(0x7f0000000e40)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000000300)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[], 0x10}}], 0x2, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000040)=0x1, 0x4) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x72) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) unshare(0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) epoll_create(0xff) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000080)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, 0x0, 0x0, 0x3, 0x0, "9ecf3315567f14d56a87d134cc409e2a652dbbf6c50480937c6fa85af81bc6fc54b71f03985ac33e31d612d97692efcda8853b8a4430503621f06679995d916cb4361795dd7dbae51d07384b7c2e6949"}, 0xd8) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00@\x00', 0x28, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], {{0x4e24, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "d4c466b340e28b05c93a072528230718"}]}}}}}}}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r2}, 0x10) r3 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = userfaultfd(0x0) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$UFFDIO_COPY(r1, 0xc028aa05, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) executing program 1: bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x20) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) ptrace(0x8, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) open(&(0x7f00000002c0)='./bus/file0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @broadcast}, {0x0, @random="ca1597489704"}, 0x0, {0x2, 0x0, @empty}, 'veth0\x00'}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000200)=""/233, 0xe9}], 0x1, 0xfff, 0x0) executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x5df, &(0x7f0000000300)=ANY=[@ANYBLOB="1201100111f625408d0405903d40010203010902cd0501a47a20090904"], 0x0) executing program 3: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r0, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, 0x0, 0x0) executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-sendto$packet-madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise-madvise detailed listing: executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-syz_usb_connect detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x5df, &(0x7f0000000300)=ANY=[@ANYBLOB="1201100111f625408d0405903d40010203010902cd0501a47a20090904"], 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r2}, 0x10) r3 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report single: successfully extracted reproducer found reproducer with 17 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$evdev detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r2}, 0x10) syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r2}, 0x10) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-mkdirat-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-write$binfmt_aout-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="90050ee7"], 0x120) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bind$packet-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r2 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-preadv-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) preadv(0xffffffffffffffff, &(0x7f0000001880)=[{&(0x7f000001aa80)=""/102399, 0x18fff}], 0x1, 0xfffffffd, 0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-sched_setaffinity-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-prctl$PR_SCHED_CORE-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-ioctl$EVIOCSFF-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x4}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r0 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="185a00000d0000000000000000000000950000000000000018", @ANYRES32, @ANYRES16, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program crashed: WARNING in hid_output_report testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(0x0, 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, 0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0001d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x90) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report simplifying C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-bpf$PROG_LOAD-syz_open_dev$evdev-write$char_usb program crashed: WARNING in hid_output_report reproducing took 1h2m36.801725897s repro crashed as (corrupted=false): keytouch 0003:0926:3333.0001: implement() called with too large value 12 (n: 1)! (kworker/0:0) ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7 at drivers/hid/hid-core.c:1449 implement drivers/hid/hid-core.c:1446 [inline] WARNING: CPU: 0 PID: 7 at drivers/hid/hid-core.c:1449 hid_output_report+0x541/0x750 drivers/hid/hid-core.c:1652 Modules linked in: CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 5.15.161-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: events hidinput_led_worker RIP: 0010:implement drivers/hid/hid-core.c:1449 [inline] RIP: 0010:hid_output_report+0x541/0x750 drivers/hid/hid-core.c:1652 Code: c1 c0 08 00 00 48 8b 44 24 40 48 8d b8 38 19 00 00 48 c7 c6 a0 a6 64 8b 48 c7 c2 a2 f2 2c 8c 44 89 f1 45 89 e8 e8 df 49 70 02 <0f> 0b 44 23 74 24 18 e9 bb fd ff ff 89 d9 80 e1 07 80 c1 03 38 c1 RSP: 0018:ffffc90000cc7b30 EFLAGS: 00010046 RAX: ccb6cbb481290400 RBX: 0000000000000001 RCX: ccb6cbb481290400 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8166835c R09: ffffed10173467a8 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 R13: 0000000000000001 R14: 000000000000000c R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f76158c1cf8 CR3: 000000000c68e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300 final repro crashed as (corrupted=false): keytouch 0003:0926:3333.0001: implement() called with too large value 12 (n: 1)! (kworker/0:0) ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7 at drivers/hid/hid-core.c:1449 implement drivers/hid/hid-core.c:1446 [inline] WARNING: CPU: 0 PID: 7 at drivers/hid/hid-core.c:1449 hid_output_report+0x541/0x750 drivers/hid/hid-core.c:1652 Modules linked in: CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 5.15.161-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: events hidinput_led_worker RIP: 0010:implement drivers/hid/hid-core.c:1449 [inline] RIP: 0010:hid_output_report+0x541/0x750 drivers/hid/hid-core.c:1652 Code: c1 c0 08 00 00 48 8b 44 24 40 48 8d b8 38 19 00 00 48 c7 c6 a0 a6 64 8b 48 c7 c2 a2 f2 2c 8c 44 89 f1 45 89 e8 e8 df 49 70 02 <0f> 0b 44 23 74 24 18 e9 bb fd ff ff 89 d9 80 e1 07 80 c1 03 38 c1 RSP: 0018:ffffc90000cc7b30 EFLAGS: 00010046 RAX: ccb6cbb481290400 RBX: 0000000000000001 RCX: ccb6cbb481290400 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8166835c R09: ffffed10173467a8 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 R13: 0000000000000001 R14: 000000000000000c R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f76158c1cf8 CR3: 000000000c68e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300