Extracting prog: 21m55.939023885s
Minimizing prog: 8m37.197112019s
Simplifying prog options: 3m14.213142416s
Extracting C: 23.101242523s
Simplifying C: 0s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 40, 2, 16, 7, 2, 16, 22, 2, 2, 5, 15, 2, 11, 13, 14, 23, 21, 2, 2, 5, 13, 2, 11]
detailed listing:
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7", @ANYRESDEC=r2], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_control_io$hid(r3, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r4 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 1:
socket$nl_generic(0x10, 0x3, 0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="417627bd7000fbdbdf2501000000000000000141000000140017000000ff"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x4080)
r2 = syz_open_dev$loop(&(0x7f0000000240), 0x41, 0x1c0862)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf) (async)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000040)={r3, 0x1000, {0x0, 0x0, 0x0, 0x1, 0x4000080000001001, 0x0, 0x0, 0x2, 0x1c, "faf98317e5a1149989958dbe53ea6accb396a2503dc3eb3fe37d58128bbad0099cebdc35f50160c9e6d6e3ab8588070000000000120000000000000000002200", "32d8cc26f70a000000000000009f3d9e234b30c5099fd3bcf409ff00ffff7bfe55cd4a5d83cd4a5249d3ffe70c7f3f800b2f1c6aa54cc50a1fcaed33ba1fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xffffffffff7ffcdf, 0x4]}})
sendfile(0xffffffffffffffff, r2, 0x0, 0x210) (async)
sendfile(0xffffffffffffffff, r2, 0x0, 0x210)
socket$netlink(0x10, 0x3, 0x13) (async)
r4 = socket$netlink(0x10, 0x3, 0x13)
r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0) (async)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0)
keyctl$get_keyring_id(0x0, 0x0, 0x4) (async)
keyctl$get_keyring_id(0x0, 0x0, 0x4)
writev(r4, 0x0, 0x0) (async)
writev(r4, 0x0, 0x0)
add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb) (async)
r6 = add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000008c0)={'syztnl1\x00', &(0x7f0000000a80)={'syztnl1\x00', <r7=>0x0, 0x8, 0x8000, 0x14bceff8, 0x3, {{0x30, 0x4, 0x2, 0x7, 0xc0, 0x65, 0x0, 0x2, 0x8e5235a2c1fec469, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x33, [@dev={0xac, 0x14, 0x14, 0x39}]}, @cipso={0x86, 0x5f, 0x1, [{0x1, 0x12, "3e46049840fde300000000ff8e5beb96"}, {0x6, 0x2}, {0x0, 0x6, "4ea04636"}, {0x6, 0xe, "fc37cdf7249016a9380cbded"}, {0x0, 0x12, "a3e42a93dce66aaa10fcbdf48ed4d6db"}, {0x2, 0x8, "a2b92bf6b4fa"}, {0x7, 0x5, "acade2"}, {0x7, 0x3, "c1"}, {0x5, 0xf, "1a789760ca1327a157681234c8"}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x40, 0x3, [{0x6459d8688415f9af, 0xc, "0b6cfae67bbd0fe9f722"}, {0x1, 0x12, "3aa8fe78a3af701eb2876c5cb4b635df"}, {0x0, 0xa, "3a3417fe169895bb"}, {0x0, 0x12, "99d58a1c51ca8eb370520c0609adab05"}]}]}}}}})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async)
r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
read(r8, 0x0, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f00000009c0)={&(0x7f0000000780), 0xc, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c000000140008002cbd7000fcdbdf250a010102000000000000000000000000fc0000000000000000000000000000014e201d5d4e2400000a00800050000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYBLOB="bc6b6e0002000000000000000000350006000000"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000)
r9 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$search(0xa, r6, &(0x7f0000000300)='logon\x00', &(0x7f0000000340)={'syz', 0x3}, r9)
r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000680), r4)
sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0500000000000000df251c00000014b700000000000000ffffff0200000000000000040005009f47a841a2b4f4fa71f982edf5d465e1ead2a59070cf2815603f1fb5b36c922b136ebe79c06223135ce52ab88ff96d0d27c32fa8103531dfb31bd51933a8e17340a960761b95"], 0x2c}}, 0x40000)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]}) (async)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]})
writev(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1)
r14 = socket$nl_generic(0x10, 0x3, 0x10)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r4)
sendmsg$NL80211_CMD_GET_KEY(r14, &(0x7f0000000600)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r15, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "6d9ae3b6e593573daf174c0777"}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x805}, 0x4000)
keyctl$unlink(0x9, r9, 0xffffffffffffffff)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
sendmsg$key(0xffffffffffffffff, 0x0, 0x40000)
ioctl(0xffffffffffffffff, 0x8b32, 0x0)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1201000000000010580413500000000000010902240001000050000904000081030000000921faff000122a00009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="4023a0"], 0x0, 0x0, 0x0, 0x0}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/185)
executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2c000010)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x82482, 0x0)
read(r0, &(0x7f0000000140)=""/69, 0x45)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001380), 0x200, 0x0)
ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd92) (async)
fcntl$setflags(r1, 0x2, 0x0) (async)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) (async)
listen(r2, 0x5)
syz_open_procfs(0xffffffffffffffff, 0x0) (async)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x24040014, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) (async)
close_range(r2, 0xffffffffffffffff, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x5)
executing program 2:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586b3"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x20000)
r1 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00')
preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000280)=""/200, 0xc8}], 0x1, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000040)={0x1, 0x3, 0x7ff})
r2 = socket$inet(0x2, 0x801, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10)
r3 = dup2(r2, r2)
r4 = socket(0x1e, 0x1, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0x5d, {0x5d, 0xb, "bac36109b815a9ed6cffb9e868471d1853ffbf40560129f7d3b1fa4404e360ba50a9f820085f4305d5066cb6d3e952a73fb6ce92c51386aeff9324b66eb1e1524bfd4f502a533017e11e8bb2cfcaef69605baa9ecee4f254e3a389"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f00000002c0)={0x0, 0xf, 0x71, {0x5, 0xf, 0x71, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0xe, "a2c0ed7c1b5d5bf555b26fb5258c5981"}, @generic={0x58, 0x10, 0x2, "27f537102841e3f1ae1a5f70d0a41bdecec3e8d46fe8a03770e331348d944e858da47fecabf5295d87f0284d487909316322348818fe397ec9b9f59c8786cfe7352e64a9ef0a88916aad9e11276a5b6f902c795dab"}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x10, 0x2, 0x40, "43b85e46", "5d1d771a"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x70, 0x0, 0x2, 0x0, 0x6, 0x4}}}, &(0x7f0000000900)={0x84, &(0x7f0000000440)={0x0, 0x1d, 0xd8, "382628524a9c776e0369f61c0a37c6db1976f47cb8fbec4d5896cd473e70052394ec58dd5d46e114826d4d06ecd78560ccd28860167906566ec25a21a2d3a6782bdac0a4c0cc37aa9da66a2aedb5f2e6799bb8f45f64dcaeee146b9b96150c5c9f63239dd49a75f211d19c6166e0ff0d4356f2da812b5b352e8406036d749863bb41dbf58c18cbbac887fc380500557dec94e611a9fefb7756941f2fae49700f38b0db75b8e00a66d2f5361e5868e1dca65f381a00ee4621c1be723dd1ae637a36bcccd949fa242e66154d98fb2416aa8b91045f05a80528"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000580)={0x0, 0x8, 0x1}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1c00, 0x353a11e0a97a2837}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xd}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "b317"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0x9596}, &(0x7f0000000740)={0x40, 0x13, 0x6}, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "9ffb"}, &(0x7f0000000800)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x1c, 0x1, 0xf3}, &(0x7f0000000880)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000008c0)={0x40, 0x21, 0x1, 0x16}})
setsockopt(r4, 0x7, 0x6, &(0x7f0000000000)="31edf7616e511ddd92b014d6c7bd2a1367af2d1b193eb80402172c7174407a891bdc4993dc6a5d36f7281659325d778930", 0x31)
pipe2(&(0x7f0000000100)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x0)
r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f00000019c0)={0x2020}, 0x2020)
splice(r3, 0x0, r5, 0x0, 0x40, 0xb)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={<r7=>0x0})
r8 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f00000001c0)={r7, 0x2, r0, 0x1, 0x80000})
ioctl$HIDIOCGNAME(r0, 0x80404806, &(0x7f00000000c0))
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 9)
executing program 3:
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3)
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x3})
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0)
r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x10e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x83, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x77, 0x2, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x2, 0x8, 0x4}}}}}]}}]}}, 0x0)
ptrace$setregs(0xd, 0x0, 0x2, &(0x7f0000003d40)="295455c61286b7a5e41406205a21c76da272878f5b5960e0662d7d3d9be80216a3b90e9efbf4000e903c89")
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x11b8, &(0x7f0000000b40)={[{0x1000, 0x4e00, "e15493fdf2802c6bc6d3a04cdb39de7ab3558da5bdceb8caf6674469431ff657ed1f85a3e7822f9fb7cd76fb4db65fc2157071dc057601aca1c89189f5935373b4e0ef4208c26e6b9940dd979e45437fcd902baa6bd67fc88bed033fee8ce5999f87bb081c3c6671156a02ebe4c4ed8cde4acbb91ac2510a538abeea0931ab2df53d86db17db693bda8b4fae6d5c136b2d977af97fc97d228975d4bebd1f072bb053defdd56e95b770055f9645b27e6438b8dc0b726a1de1981c5b678dfadb5ab7a04001400b4bdc35da017fdd94e99e82ac1afaa0d0a755e0960a64f96a28e087064fd93fee0bdb379a27c87d9c93a3ca35e35ad7c6ff123cf3dc1bcba36201f5617a9ac78102e1c2efbf1136eb0fe6ec3b934a20bc1d6fbb3239b5cc0a5600038b8051034b997afc65116d4d28c9e40061dfe2abf8eedc9d9342778a29db09684e7d35b7acc3d134c7a32e57f1bad45346bafedc83a4db3d267632876251eef0ee202eab05cb5a8e1228badece6461eedb8249241d142f55ef2a854087e5b0e585f71b24f7c0458a7576b8267e7a89cc6156233666cf0816e1b3a2f1cacc14a4765152ea35745ef0f4535275079005529cb54f1d9a79c0b30c86cd34d96ed42a92f86752d0048e345405c1fb30e533ad7523f3e3bb769895fb19d0e4fb308fef400594a7d1a30812b3c9466a840c70bb28194c64214947be2f99897d560282a4030cfd5f282522cb029368a424dca506beb01dab5783902300e818f521dc0cd82f7a433f8bbee0afc1c7d093f1c35da8527b0a65631c0bca14f4cda834003d6bea2d0745abc7345023ab7415f02a23179d1afb57defb4ce7e69e23e926fe9b29e744ad7e09ee6bafde73526c66dd04437e93defc63d0c2c2d27c6bdad5255181737e69cc53bdccfdccea783b9f4afa215761fd9125a3610d1bfe6c4b7af12f69bca35fe6a5d26949f47851e735499aa5d021bd2969feff4bf43442de5aa02f8d0da4d18b840b8f2bb6f86b9121664d1ff54c132aa3db5818f33e0ef2a65ddb7033503ace4df65123e4a9872cf7675e27693a855e25f32c7de671866572b0bdc49a26efbbfad9b94d1dc6de3cfcba3a3a810f7f677c0abd3f266921637f7e934547c0f128f633b86b247fc5addec05fb8f32a1a13e7e09f77ba25c03bbcd24b63f72bbbf8713f53a6f1dd726a3bd8cb734f4405ce44be04282d3e771777f220859138e27c5abfbe3ca6f8d40ef80debd7bc3165699c79aa9ee8933f5dc367e190c4d0972a96decc27d340c994a3b926b360562961ba305b60404374a216a9b3499f8d18a954f7d829b149565d064e457524ba80e28b810f8fbf2700b439233a88c5feccc2f5c48c1174af121043bb8e0a0f56c9efa0b3617e563b38f277d24bd21710700bebe965cd8fab648d6d302a3cc75787a19d560d32d6869a52f90c0bd579bc24bbd283e421d038e78df677025979ea448935ba8cc6d4eafab8aad1e4cd33e961506c0b3f1144e7655149b22c08693aa4ad9f8fc9b385f463c0dd6daf9fbe87d1ecb7f0f35240019045482c8d747d4490dc41b9fd82407b5ac96cbe7dcf804ca32ef3678906bc96e29bf41df8df36afe33affebe3be24bfedf6eb04e61b51ff71f1287c286b65b9263120200f330bce36fa46a1a8e11ca1e8fe95e12510e1689bd529ef817e0bb55865cc3ac150649ae4f6a5a1debfc7d4337c5ca2772cbad23989d0f630ed03119367923d67b91ca3fa3092b7865f8ee089e836943d028979221cac6cb12d69ce77d83d72f4a33414a196af4df781ccfbf7df7f9c9ae7e0273e2d73079f02aa286ecf9b93b1dbf636e68eb9d1cfd8561317412e260510fe4a75c894c4e643be3f7c1c1ef8f0d9194713052cc423325053da0baf24236059a308f1a4f0b2ae5c0c215b273c9519da43e6f6e0e46ddac4c76702f605f0289a6cff8ab5fb061b491fb75784a7f8fedeffb42038b0a7af70ddfa621988623f9f27d7d96eb856073eea6dcbb74abdd9456c1259d2c7f3e39126f4e2036c84075fc7c6a73a99489abe8e0b24d760557454e636e0932e17aebc83ccd057ecc0538847173fb663de84b79ce32b8a487a345e203cd5027b941980426e56ce73ce2b89b3cd910f5fdf5a9f58742da15c489d58b3dbdd4d08cdf170de708e82f0bb93304dbef68d8776a8ca2259fd2dc412bfa16009c9ae83975e29abdca7f2d61c77d9c3f8db5345e3438869235afdbd311567c739167cf5433c7ff732f3ef6acb07ea8952feee9192b2deb5e0473cd961ebb7e145a647b2228935f75e1a6732110ed5fffeb87ac5053e12ab555d7af95f6912def6344542c1db0643d7622869742be83f50202b78c2eb97d52e43154691cc7943d57668376cdbfca2ab4a3966ea7b601759c949c51a34e4216b3d0f91e0014befa40860371c8815195878e25430d5c1f71529481d34d3459f1ec1ed4fccf6026b81172a9a220344a593ce307063cb33cf1164512be6f9d2a7748f77dda7daf9bfae1432b841fbfb8756090fc76c2905f48804ccce86d9a6c9433cc84341202e154463976b463e7cfe9fb5a0a5f0cc91dae9dabfdf709a70bd126fe55a8f381bd4f48b93daa47123125159ef3ac0ba8e8ae4e6832d23ad0af6d06f65e30dff1c8b1f014be5135eaed5945fe3d6c04112f50eb9ade6b4cdb1a3c7faae190e0844bb8eb78a499d5c512aed83837f0a5db488a68af92b85801a835ff55a19438d72fb447ce54faa123f72e1dd6838a6ea70823479661be5c8e71dfdd387cf80c5bf470e39adb79fdffb4c246242ffb97b6e4b795a03675365a7cc70dc1fda530ed575184edaefcda5b03f013849508f6b1ed945f0cf80a261edb1704a19ee49a9384629e32c450e781fc78a77fcfbe507a1c067e8ad7a52ff8a07ac2d6a643cc0103cd41c32e47d435c739a9b298996c9674554fbc776f0fedb5f2929fd1ad94eeccdafec5554f8f1ddde14e0e2b38519ebe96503eb723443ca983ff3b537d8196d696732ee501f938b7b84526021763e4cda81ac89c28ddd8007d3c123f69562a21cbebd3c4445de798e4bbad1ca91e7cb3d97e1fc6e8d26c57584ea41b4947125ed9e23803d6805784c774f6025212d17c5fa330d780189c71fb91db7c9245eccb5287c2b89a41ac04638650698dd55c4bdff88feb3f6b28a50a99e5ca269cc596480bf9cc5425aa97e2f994693063b4e259643c69cdb647adf82167edb1c08aff350ae273b5c9e0399fcaab1046aaac0911072a8477af3998b049909dcfd31f645c8c720c9036819e27f8e829a39fdb826661c3967b7c2e37a3588ebf57f9935e95c7e95ea7935a36f2e5a9a61e60c1efe3201173b4eca99516e8bbe8a8d7fd999fd97bb2c6d30cb20a24eba2161de0df66e34007529c65dcfb74d96a142a553913e1918cf0109db1fbd736614c2273d8bf67e9caddeb59b8bfd31146102acbbbfc92abba1e0b13816ce7325016e22fb0ad42151a3eb73fb48bcdd326e253db836c7461821d6b05e5c7e9df4780a3653db6fd663e05656be8741e77f14a02211527589d19c0f47dc78d42d1d66001d5400ef7aeb22455cdd087489b28921793793a17c9271ae1ad75cbceb4f24c58c8be36db7ca0d0444bc006c837931c929f1cecbbe2a4826753fbeee4799c2586c7c709fcb2e732faa358abf9f69d5a90f73d074400b070d6802e5b27fd87a619e737bd92bff374b67e614ba4748e30a1e5248e15e4726b46e9224c96a87a4912f3f4082aa120e2cf837784e0cb3f7e1721ae112a0187eb9863af76be1d72d6baaeaa88c068f08cddd690549bb8d3f63aff5ed784bd3959fbc94b06ce0e5997aee9620c3b49cf0e5aa49780983abfd1adc8c633cc272703776ee809b1cfea9ac721739e35009a5ff57b8321da2948adaac521298ab1ba8becfe40a4112b110fb6c5fa83472f85fc2d5bd616315e1b2d7250bf32370b75327bea95458d4afd3b6383e32c7aff494fa7639917a73b473829242b36099406f28c58af566721c57878de7f157ca7120fab1c6e85c4ae9038eb1d0fd2f3c9070ced829642305337010f8340a133adde66c884784fc305af5831091c32a01675bd64e00e3be6b4cb38ecbb063ba8aa5c1194efa97bed24785d587750707a274167645dbb707d0a7edf4999881fd4c08d0419c006f7f56d756c6a193462721f0093d714d9760e31c744c82ad27ee8f87225f390d023b2b6a7319548793b87fe10a20b1caebc7c4a40cdc27d2fa973d389b379546a6ce32be414e00035652fb200bafdb7675a684b757b1173849913559fa5d5a5be23c5673b4bdb72c28d3ef13d810fbeb8bd4881750d5d230df147514a2c7230666328a43d4116e6f0579dfd0ca4459d2b82f6eebbfaad66db18ac37a97c5e74ccbdce587bc7999e05c7a28678168d7299b157ab1e920e3b2c0771b5ed6cdace19dedd68f54e9488cd586a6ab8b0143e403704b5520820ef4ff7af40f6c9f924f6d67389d15dc7f9a7b21e5d3cc37590ce9de58959ff151f815d33616a4c0abcf9b5771a551fc68690cc2095315384381b3ee58d138f4391c6d7227583c70248507dfa9c727929fca8f8635b53b90f25dd66dc3cffba35894093ecb8d0d03582919f87abb867ef709e49ab0bcf122718db188a55f29eb38a88f5ce204ede918e0c03034c41a06a705b09565caf8b6f10ac7c222f0eea253d8efdd70e0f9825a73f50e8086312c61366da286e54b19b5a4a2833134ef4629a852568285cf21fc8bf05bc3f8c66cfde9055da56b3866aaf28ede8ef58329d94114ce7388295625388cb1f72d880f2cd6d6302f6e8694770139729da9458d287a53857a3aa5023ad45e7724bfd8b2c5c25498ba6338312a88b5df839025a3c470f1469305ce7dfd416933c85b2451c14f285164a7e47ce90ff3a08ae1b64930727d469ff0bf9e7fc87de4484e544886fd476fd9822f8a710844732b5c55f34302851a2cf6cf8a8b891ca9b548a48318609cacb3e10353de1030e99f67b02016780731a380fd8d22e00c085ffc26ca7f7fd0b04deb425e36b041a34da8119db4cef3401c872a32c3f446f22c9609422ae6906ebe7a01aa4d463abab38c6259ff5bceabda221ce1605c73d4417282ef4a7ffb4d768e34aa98723174121aaadea5467b3bb6a0c893c28c2fe55143b23a55021504e24b982542b00d15c848025b400beb4b44d235aa9bdd33c4b572bab4fc2ef33255457ffed4f303cc62e36aaf1f764d181251281f7ef5659a66400abe8320eb1aad146da5a79957e4e5b27b070481c643b03a75905e87fdc930decbffd606f923f22bf103828338c93969d0633d86773b7f4522c2dade6f7c114139d48ebf246aedf82e28967468743e5539f67c2d33d2c257a2af237967a18ff1631989223a1084b9b9400fd6cf65d998f160e7edf1f709895c66e43e90ea6a753bb067445529f658181d8f9a6109c2283961d734255cfccc7e59d4663fb4753a0b5a62e4f67e67cc448e6e11e419336b5dbb98d9dcdd5263774d8b59a366392d2151e355dbe006af56ba9e894f51d540e5051244e085e4dbcdf39838bf8d9cf9746392adae713190ebeb4f3d6164f8a5b9e35c4e8476b725677c8ac44ec6c5294f679825d3f3834bb8d3120cd4f38fe969e30098ef5ea2d76b92dd344a4f116dc1a8dedab2f5b237cfec9197f99b73756cf37a298b735e972d2cd7e0fa5c89121b9526911e329eb7774c4a8fbef30d36e4fd457f05b76fbb762c6affa831cf63a7fb45a47f977aa7d48bbe171af183463a94"}, {0x7, 0x4e00, "69d90144573908"}, {0xba, 0x4e00, "17b32ee1785d2e5ccb793914cd6f28b1bc47c0687eb3ec5e8120c5e2a3a6ab44175266ac51c173e0d93eff205c6a054fdf1c265a22d2691599ff645a676e7b1943165936dc3a688a29c994c2aefeccfdf00e4acad520d796f86830e21aaee47c7ce7de830feca3b39f00e5861a39d2f2721afe5273be605889944e714b47c312a2d67b950363579cfa05eccf00eebc3960e16f07f4ae14608a934cdf7a5f41f225364224bee6159dd1a93bfcae43eb49129713c901b4c926f6c7"}, {0xe2, 0x4e00, "6bcac55caf0d2e2968216d5ce1b8dd96021fdbad5d40f3c13b0c73a93184c7d6f542af29243417f4681e319ab2ccdd601ec5c2e38de34b6bab7d0be82fd2ef383312bce04ad04e45119b842b5b04f247dabd4156f48184921efed46adb109bfbeeacdfa5c3fe8095f63dd7574b7a4eed79170f1f836c8b5c287ff546a330e0af44d6d1a7dfd07f3fe4450c799a53b9a5693d3de0f3db07ba1dc92c5f93b325faa7ed8fb7686549fb311a75008c51804d71b510ee3ea420405a441200af6c7e3f5b80788768ac2658b458b4dfbf55d8dce05d2bdc450d33362ddc3f35ee5e7d3a5b59"}]})
syz_usb_control_io(r3, &(0x7f0000000540)={0x2c, &(0x7f0000000100)={0x20, 0x21, 0x29, {0x29, 0x1, "7d611870cced50a6dc9b9baae6e4fb07347310bcb53837f15d7c0201458010d302afc5dfce714d"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="000a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r2, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x0, 0x2, 0x87, {0x87, 0x4, "2d69d431c3064d0fb3a658130e712c9e939a1e2a6ad24640b3ce63280d19d811918f688f00ccbf2cbe19480b41ca3bdae78eaa4a542b5a7cfb1457d2805a520db803df2a3ab7b29dda8bcddceb3f00360908aaef3c3c73bbbbd561db8ae5f98c36a4f3793b0aaaea4fdb8383fd581f47a6628fa08e0f40665e82ab711ee2c6ac6451aab665"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc01}}}, &(0x7f0000000700)={0x44, &(0x7f0000000400)={0x40, 0x15, 0xfb, "04a87a25834acacccf46b8fff5c32eb534971baed3a20d78b328c3d1f608d86994816fcb2b6334b0c63516cea16a03b7b02bb06086ff45c0883834d22f7fa8da60ff09016c1daa00dc40952f5f1c2ba024769a5ffc706e6d4ff1a0874560aaa54f2737b883068a66f28e69e125d7bec48cbc59b5e794535f4d18aa4fc4010e9ee7f64bb3a72d81c9ceca4e050d70f9fe460c8337ce807b063fca726183b94b0b02c6e8d267d38f0e537dc61361336a3dbaca171b97eabc5b2fe353e9b7c7afb48e5c0fddb5c967cbbf8dfb85dc546cc30199212588b7f2ff4e6b8d3a8776b074c14859c183efc3f2b57c0550402476a98803116c93f20f233760a0"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x8a}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xe}, &(0x7f00000005c0)={0x20, 0x81, 0x3, "0192f7"}, &(0x7f0000000600)={0x20, 0x82, 0x1, "8a"}, &(0x7f0000000640)={0x20, 0x83, 0x3, "444615"}, &(0x7f0000000680)={0x20, 0x84, 0x2, "86a5"}, &(0x7f00000006c0)={0x20, 0x85, 0x3, "a3c87c"}})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c0014"], 0x184}, 0x1, 0xffffff80}, 0x0)
executing program 3:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r2], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000002100)=0xfff00000, 0x4)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00')
lseek(r1, 0x2000, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd7000000000007f000001000000000000000000000000ac1414aa000000000000000000000100000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c2900"/229], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x5cf, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000, 0x8}, 0x0, 0xfffffffe, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8)
write(r3, 0x0, 0x0)
sendto$inet(r3, 0x0, 0x0, 0x0, 0x0, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0)
capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40})
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, 0x0)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r4, 0x5386, 0x0)
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0)
write$binfmt_aout(r5, &(0x7f0000000380)=ANY=[], 0xff2e)
ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000140)={0x0, 0x4000000, 0xfffffff9, 0x7fff, 0x16, "0062ba7d82000000000000000000f7ffffff00"})
r6 = syz_open_pts(r5, 0xc0000)
ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000100)=0x12)
ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000000))
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32)
sendfile(r7, r7, 0x0, 0x1000)
getsockopt$MRT6(r7, 0x29, 0xce, &(0x7f0000000040), &(0x7f0000000080)=0x4)
executing program 3:
syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xaa, &(0x7f0000000800)=ANY=[]}]})
r0 = syz_usb_connect$uac2(0x2, 0xe7, &(0x7f0000000380)=ANY=[@ANYBLOB="12010003000000400c2018104000010203010902cc000301070009080b0100010b20000904000000010120000924010300085300050c240306040381060700000207240c02ee0305102402050402033d01a40000000507010f240d0200000401000100020002000f240d05010003010001000200010009240704020005022000090401010101022000092402010109022a0109050109200003070708250100009dff01090402000001022000090402010101022000102401060802038209100006050508250183000604000000000000000000000000479d3fc2f251d11f63eb734376d28ad4169414cf27f2bacb56383f1711ce83d25376397cf316c25ae376769d56ffff7f1cd1a416ac75be90721ff169fba1410d3d935b67fc65271f3bf58cbbf5c0b036cebfbce826137425ca43a39426fc65d14a4ba8fcec"], &(0x7f00000004c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x250, 0x1, 0x7, 0x1, 0x40, 0xa}, 0x0, 0x0})
mount$tmpfs(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6e725f696e6f6465733d652c00a9cebb7649d266ded5558ed12c4e0580e0a02cb338bb8b976751c7ea2693110667401722c0c29a692cd00f6682a86dd6717129d1cdb1ea57281e1c432ac8c36755cf44e83035af4131651b8f0535f16e11d6"])
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="200000005f000100080031000000000000000000", @ANYRES64=r1], 0x20}], 0x1, 0x0, 0x0, 0x4040040}, 0x20000000)
syz_usb_control_io$uac2(r0, &(0x7f00000008c0)={0x14, &(0x7f0000000580)={0x0, 0x22, 0x2, {0x2, 0x30}}, &(0x7f00000007c0)=ANY=[@ANYBLOB="00033a0000003a034ad8b76a0fdfdd8d38257df6ee30d8951584e20a5a0057fa22f51a5654c84520c4d0e2b017559cfc7fdac99cb500dc07f57574dc98e4d163"]}, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="cc010000100001000000000000000000ac1414aa0000000000000000000000000000000000000000000000000000000044030000000300030000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000000000000000000000100000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000002040000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000500000000000000000000000a000100000000000000000008002300f8ffffff480001"], 0x1cc}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000080), 0x3)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x11a, 0x4, 0x0, 0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r4, &(0x7f00000004c0)='./file1\x00', 0x5)
r5 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98)
fcntl$setlease(r5, 0x400, 0x1)
fcntl$setlease(r5, 0x400, 0x0)
sendto$inet6(r5, &(0x7f0000000280)="eec12b1100b5b76fbd1d7523e64c00ea23c7cf60ddd144d046449e4af00540b57be4b2513ae09640906433b88882cfaed02b82c533371c3eb0b602a82bb03a547dbe599b9ce4420bdbf2ef2d5873075bd596bd3dbb054c0423f7b0e59d303a3912327542de87c6569e879cc888ad49f0476bd14c647d90644a112b8bb728fbdaed4130a9ba2681704014e1d4ffc4938457392def16350291654980bab3f398058d7346c6eaccfdeef19f56c6981050be5bbb2514e1de62d49896ccdbadbe3c550746022c6988fe13dd14ca2282a18cfe40f05a3c476bb110a7c501d03b0b920ad3517a75", 0xe4, 0xd0, 0x0, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0x6a)
executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)
executing program 0:
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x40000104, 0x0, 0x9}]})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect$uac1(0x5, 0xaa, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ff00030100000009040000000101000002240100000002"], 0x0)
r5 = dup(r4)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000400)={0x24, &(0x7f0000000740)={0x40, 0xb, 0xfe, {0xfe, 0x30, "5b0ca40af96e7a62b850d07c96f6bced578d08fdfa89cffc990f37582b94045901a422d3f67a96c77d2f8b0a174ad268fe94bba1978faf619d79defb47348e62086633bb4322c9069162d1512e297a9741d846364891e2fcc1a92463c16ec4006992ab3700b680a78308eb683cc71ac1bd37bdad74dc1e3d5f54b83ce8a1b45a3fadbb5b9f9596bd798df737123036347de591a3799219922ca994868085cf25f4693a6899a75b776574a96d0c5b00f1ed05c808a432b8f54d4b77ba2cc8d12a77471be85bfebf59626444591e3551d988916901b009993f5ce5521c311fab7dcd2444c48b87288702b5ab6cdc0af796d792129eb1803741d883208f"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000000)=ANY=[], &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0xba, 0x1, {0x22, 0x70f}}}}, &(0x7f00000005c0)={0x2c, &(0x7f0000000440)={0x0, 0xa, 0x78, "c58e0253e33f099ce32240b3937f839b8e8b9ce258dccdfe32dd4fdcdc18c8a56a790d772d3b9ded78069fcd53d6e3a9849a806e7fa39e9f14234f8246fb908d298a79310fb1bd694da227b92d9d42f0f284358166c69c5c21682bae04a091dc70249b101c4c8347cf3dbd665c5e4cdb0f4220271f7bb0e6"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000000)={0x0, 0x8, 0x1, 0x5e}, &(0x7f0000000040)={0x20, 0x1, 0x3c, "c3fbb53d7d7e5d9086ae11f3e3fcd69aa07a05640bdc8a13c6cffd925f28f5b5e6b118a68522f324d19935cec5a7acde6346b9873ec3164d4900376f"}, &(0x7f0000000580)={0x20, 0x3, 0x1, 0x6}})
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r3, &(0x7f0000000600)=ANY=[@ANYBLOB="00008914bbbbbbbbbbbbaaaaaaaaaaaa88a83b008100100008060001080006040001000000000000ffffffff0180c20000010a0101021e173f3705ff78b60276b42b7f22edc2595fd8320dabd18e90d026df8a30b614b6f37554dc36ba869f47432bac215bf4de5de7b89ad1707eb551cc25a7d3da7a430feec84eda2e6a20bbdc2f7476d27163d5ae63d9aacf678059c7afcaf4c7f6bfa48be71c392585aca2de2bcd60013bd0c4c26bb910b443255eae3df3097185230c04a19623403c5e0f20c7dac9d616cc26e2088df883fabb2e6022bb095b69006f3af8e81034f1ea5f91325fefa52e3f79df90bb83447a8c088c07cc930cb5981dcec5f27947c89400868a6964692b008dd951916d931b9362acef961dca17dd30a685b8b52cffc0d33cec7b40d62e5f7ba449c80c1742ba"], 0x36)
syz_usb_connect(0x4, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000400000109021b0001110000000904000001"], 0x0)
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c0014"], 0x184}, 0x1, 0x80ffffffffffffff}, 0x0)
executing program 0:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r2], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)

program crashed: WARNING in untrack_pfn
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <23>
bisect: split chunk #0 of len 23 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 5, 15, 2, 11, 13, 14, 23, 21, 2, 2, 5, 13, 2, 11]
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 9)
executing program 3:
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3)
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x3})
syz_usb_control_io$hid(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0)
r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x10e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x83, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x77, 0x2, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x2, 0x8, 0x4}}}}}]}}]}}, 0x0)
ptrace$setregs(0xd, 0x0, 0x2, &(0x7f0000003d40)="295455c61286b7a5e41406205a21c76da272878f5b5960e0662d7d3d9be80216a3b90e9efbf4000e903c89")
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x11b8, &(0x7f0000000b40)={[{0x1000, 0x4e00, "e15493fdf2802c6bc6d3a04cdb39de7ab3558da5bdceb8caf6674469431ff657ed1f85a3e7822f9fb7cd76fb4db65fc2157071dc057601aca1c89189f5935373b4e0ef4208c26e6b9940dd979e45437fcd902baa6bd67fc88bed033fee8ce5999f87bb081c3c6671156a02ebe4c4ed8cde4acbb91ac2510a538abeea0931ab2df53d86db17db693bda8b4fae6d5c136b2d977af97fc97d228975d4bebd1f072bb053defdd56e95b770055f9645b27e6438b8dc0b726a1de1981c5b678dfadb5ab7a04001400b4bdc35da017fdd94e99e82ac1afaa0d0a755e0960a64f96a28e087064fd93fee0bdb379a27c87d9c93a3ca35e35ad7c6ff123cf3dc1bcba36201f5617a9ac78102e1c2efbf1136eb0fe6ec3b934a20bc1d6fbb3239b5cc0a5600038b8051034b997afc65116d4d28c9e40061dfe2abf8eedc9d9342778a29db09684e7d35b7acc3d134c7a32e57f1bad45346bafedc83a4db3d267632876251eef0ee202eab05cb5a8e1228badece6461eedb8249241d142f55ef2a854087e5b0e585f71b24f7c0458a7576b8267e7a89cc6156233666cf0816e1b3a2f1cacc14a4765152ea35745ef0f4535275079005529cb54f1d9a79c0b30c86cd34d96ed42a92f86752d0048e345405c1fb30e533ad7523f3e3bb769895fb19d0e4fb308fef400594a7d1a30812b3c9466a840c70bb28194c64214947be2f99897d560282a4030cfd5f282522cb029368a424dca506beb01dab5783902300e818f521dc0cd82f7a433f8bbee0afc1c7d093f1c35da8527b0a65631c0bca14f4cda834003d6bea2d0745abc7345023ab7415f02a23179d1afb57defb4ce7e69e23e926fe9b29e744ad7e09ee6bafde73526c66dd04437e93defc63d0c2c2d27c6bdad5255181737e69cc53bdccfdccea783b9f4afa215761fd9125a3610d1bfe6c4b7af12f69bca35fe6a5d26949f47851e735499aa5d021bd2969feff4bf43442de5aa02f8d0da4d18b840b8f2bb6f86b9121664d1ff54c132aa3db5818f33e0ef2a65ddb7033503ace4df65123e4a9872cf7675e27693a855e25f32c7de671866572b0bdc49a26efbbfad9b94d1dc6de3cfcba3a3a810f7f677c0abd3f266921637f7e934547c0f128f633b86b247fc5addec05fb8f32a1a13e7e09f77ba25c03bbcd24b63f72bbbf8713f53a6f1dd726a3bd8cb734f4405ce44be04282d3e771777f220859138e27c5abfbe3ca6f8d40ef80debd7bc3165699c79aa9ee8933f5dc367e190c4d0972a96decc27d340c994a3b926b360562961ba305b60404374a216a9b3499f8d18a954f7d829b149565d064e457524ba80e28b810f8fbf2700b439233a88c5feccc2f5c48c1174af121043bb8e0a0f56c9efa0b3617e563b38f277d24bd21710700bebe965cd8fab648d6d302a3cc75787a19d560d32d6869a52f90c0bd579bc24bbd283e421d038e78df677025979ea448935ba8cc6d4eafab8aad1e4cd33e961506c0b3f1144e7655149b22c08693aa4ad9f8fc9b385f463c0dd6daf9fbe87d1ecb7f0f35240019045482c8d747d4490dc41b9fd82407b5ac96cbe7dcf804ca32ef3678906bc96e29bf41df8df36afe33affebe3be24bfedf6eb04e61b51ff71f1287c286b65b9263120200f330bce36fa46a1a8e11ca1e8fe95e12510e1689bd529ef817e0bb55865cc3ac150649ae4f6a5a1debfc7d4337c5ca2772cbad23989d0f630ed03119367923d67b91ca3fa3092b7865f8ee089e836943d028979221cac6cb12d69ce77d83d72f4a33414a196af4df781ccfbf7df7f9c9ae7e0273e2d73079f02aa286ecf9b93b1dbf636e68eb9d1cfd8561317412e260510fe4a75c894c4e643be3f7c1c1ef8f0d9194713052cc423325053da0baf24236059a308f1a4f0b2ae5c0c215b273c9519da43e6f6e0e46ddac4c76702f605f0289a6cff8ab5fb061b491fb75784a7f8fedeffb42038b0a7af70ddfa621988623f9f27d7d96eb856073eea6dcbb74abdd9456c1259d2c7f3e39126f4e2036c84075fc7c6a73a99489abe8e0b24d760557454e636e0932e17aebc83ccd057ecc0538847173fb663de84b79ce32b8a487a345e203cd5027b941980426e56ce73ce2b89b3cd910f5fdf5a9f58742da15c489d58b3dbdd4d08cdf170de708e82f0bb93304dbef68d8776a8ca2259fd2dc412bfa16009c9ae83975e29abdca7f2d61c77d9c3f8db5345e3438869235afdbd311567c739167cf5433c7ff732f3ef6acb07ea8952feee9192b2deb5e0473cd961ebb7e145a647b2228935f75e1a6732110ed5fffeb87ac5053e12ab555d7af95f6912def6344542c1db0643d7622869742be83f50202b78c2eb97d52e43154691cc7943d57668376cdbfca2ab4a3966ea7b601759c949c51a34e4216b3d0f91e0014befa40860371c8815195878e25430d5c1f71529481d34d3459f1ec1ed4fccf6026b81172a9a220344a593ce307063cb33cf1164512be6f9d2a7748f77dda7daf9bfae1432b841fbfb8756090fc76c2905f48804ccce86d9a6c9433cc84341202e154463976b463e7cfe9fb5a0a5f0cc91dae9dabfdf709a70bd126fe55a8f381bd4f48b93daa47123125159ef3ac0ba8e8ae4e6832d23ad0af6d06f65e30dff1c8b1f014be5135eaed5945fe3d6c04112f50eb9ade6b4cdb1a3c7faae190e0844bb8eb78a499d5c512aed83837f0a5db488a68af92b85801a835ff55a19438d72fb447ce54faa123f72e1dd6838a6ea70823479661be5c8e71dfdd387cf80c5bf470e39adb79fdffb4c246242ffb97b6e4b795a03675365a7cc70dc1fda530ed575184edaefcda5b03f013849508f6b1ed945f0cf80a261edb1704a19ee49a9384629e32c450e781fc78a77fcfbe507a1c067e8ad7a52ff8a07ac2d6a643cc0103cd41c32e47d435c739a9b298996c9674554fbc776f0fedb5f2929fd1ad94eeccdafec5554f8f1ddde14e0e2b38519ebe96503eb723443ca983ff3b537d8196d696732ee501f938b7b84526021763e4cda81ac89c28ddd8007d3c123f69562a21cbebd3c4445de798e4bbad1ca91e7cb3d97e1fc6e8d26c57584ea41b4947125ed9e23803d6805784c774f6025212d17c5fa330d780189c71fb91db7c9245eccb5287c2b89a41ac04638650698dd55c4bdff88feb3f6b28a50a99e5ca269cc596480bf9cc5425aa97e2f994693063b4e259643c69cdb647adf82167edb1c08aff350ae273b5c9e0399fcaab1046aaac0911072a8477af3998b049909dcfd31f645c8c720c9036819e27f8e829a39fdb826661c3967b7c2e37a3588ebf57f9935e95c7e95ea7935a36f2e5a9a61e60c1efe3201173b4eca99516e8bbe8a8d7fd999fd97bb2c6d30cb20a24eba2161de0df66e34007529c65dcfb74d96a142a553913e1918cf0109db1fbd736614c2273d8bf67e9caddeb59b8bfd31146102acbbbfc92abba1e0b13816ce7325016e22fb0ad42151a3eb73fb48bcdd326e253db836c7461821d6b05e5c7e9df4780a3653db6fd663e05656be8741e77f14a02211527589d19c0f47dc78d42d1d66001d5400ef7aeb22455cdd087489b28921793793a17c9271ae1ad75cbceb4f24c58c8be36db7ca0d0444bc006c837931c929f1cecbbe2a4826753fbeee4799c2586c7c709fcb2e732faa358abf9f69d5a90f73d074400b070d6802e5b27fd87a619e737bd92bff374b67e614ba4748e30a1e5248e15e4726b46e9224c96a87a4912f3f4082aa120e2cf837784e0cb3f7e1721ae112a0187eb9863af76be1d72d6baaeaa88c068f08cddd690549bb8d3f63aff5ed784bd3959fbc94b06ce0e5997aee9620c3b49cf0e5aa49780983abfd1adc8c633cc272703776ee809b1cfea9ac721739e35009a5ff57b8321da2948adaac521298ab1ba8becfe40a4112b110fb6c5fa83472f85fc2d5bd616315e1b2d7250bf32370b75327bea95458d4afd3b6383e32c7aff494fa7639917a73b473829242b36099406f28c58af566721c57878de7f157ca7120fab1c6e85c4ae9038eb1d0fd2f3c9070ced829642305337010f8340a133adde66c884784fc305af5831091c32a01675bd64e00e3be6b4cb38ecbb063ba8aa5c1194efa97bed24785d587750707a274167645dbb707d0a7edf4999881fd4c08d0419c006f7f56d756c6a193462721f0093d714d9760e31c744c82ad27ee8f87225f390d023b2b6a7319548793b87fe10a20b1caebc7c4a40cdc27d2fa973d389b379546a6ce32be414e00035652fb200bafdb7675a684b757b1173849913559fa5d5a5be23c5673b4bdb72c28d3ef13d810fbeb8bd4881750d5d230df147514a2c7230666328a43d4116e6f0579dfd0ca4459d2b82f6eebbfaad66db18ac37a97c5e74ccbdce587bc7999e05c7a28678168d7299b157ab1e920e3b2c0771b5ed6cdace19dedd68f54e9488cd586a6ab8b0143e403704b5520820ef4ff7af40f6c9f924f6d67389d15dc7f9a7b21e5d3cc37590ce9de58959ff151f815d33616a4c0abcf9b5771a551fc68690cc2095315384381b3ee58d138f4391c6d7227583c70248507dfa9c727929fca8f8635b53b90f25dd66dc3cffba35894093ecb8d0d03582919f87abb867ef709e49ab0bcf122718db188a55f29eb38a88f5ce204ede918e0c03034c41a06a705b09565caf8b6f10ac7c222f0eea253d8efdd70e0f9825a73f50e8086312c61366da286e54b19b5a4a2833134ef4629a852568285cf21fc8bf05bc3f8c66cfde9055da56b3866aaf28ede8ef58329d94114ce7388295625388cb1f72d880f2cd6d6302f6e8694770139729da9458d287a53857a3aa5023ad45e7724bfd8b2c5c25498ba6338312a88b5df839025a3c470f1469305ce7dfd416933c85b2451c14f285164a7e47ce90ff3a08ae1b64930727d469ff0bf9e7fc87de4484e544886fd476fd9822f8a710844732b5c55f34302851a2cf6cf8a8b891ca9b548a48318609cacb3e10353de1030e99f67b02016780731a380fd8d22e00c085ffc26ca7f7fd0b04deb425e36b041a34da8119db4cef3401c872a32c3f446f22c9609422ae6906ebe7a01aa4d463abab38c6259ff5bceabda221ce1605c73d4417282ef4a7ffb4d768e34aa98723174121aaadea5467b3bb6a0c893c28c2fe55143b23a55021504e24b982542b00d15c848025b400beb4b44d235aa9bdd33c4b572bab4fc2ef33255457ffed4f303cc62e36aaf1f764d181251281f7ef5659a66400abe8320eb1aad146da5a79957e4e5b27b070481c643b03a75905e87fdc930decbffd606f923f22bf103828338c93969d0633d86773b7f4522c2dade6f7c114139d48ebf246aedf82e28967468743e5539f67c2d33d2c257a2af237967a18ff1631989223a1084b9b9400fd6cf65d998f160e7edf1f709895c66e43e90ea6a753bb067445529f658181d8f9a6109c2283961d734255cfccc7e59d4663fb4753a0b5a62e4f67e67cc448e6e11e419336b5dbb98d9dcdd5263774d8b59a366392d2151e355dbe006af56ba9e894f51d540e5051244e085e4dbcdf39838bf8d9cf9746392adae713190ebeb4f3d6164f8a5b9e35c4e8476b725677c8ac44ec6c5294f679825d3f3834bb8d3120cd4f38fe969e30098ef5ea2d76b92dd344a4f116dc1a8dedab2f5b237cfec9197f99b73756cf37a298b735e972d2cd7e0fa5c89121b9526911e329eb7774c4a8fbef30d36e4fd457f05b76fbb762c6affa831cf63a7fb45a47f977aa7d48bbe171af183463a94"}, {0x7, 0x4e00, "69d90144573908"}, {0xba, 0x4e00, "17b32ee1785d2e5ccb793914cd6f28b1bc47c0687eb3ec5e8120c5e2a3a6ab44175266ac51c173e0d93eff205c6a054fdf1c265a22d2691599ff645a676e7b1943165936dc3a688a29c994c2aefeccfdf00e4acad520d796f86830e21aaee47c7ce7de830feca3b39f00e5861a39d2f2721afe5273be605889944e714b47c312a2d67b950363579cfa05eccf00eebc3960e16f07f4ae14608a934cdf7a5f41f225364224bee6159dd1a93bfcae43eb49129713c901b4c926f6c7"}, {0xe2, 0x4e00, "6bcac55caf0d2e2968216d5ce1b8dd96021fdbad5d40f3c13b0c73a93184c7d6f542af29243417f4681e319ab2ccdd601ec5c2e38de34b6bab7d0be82fd2ef383312bce04ad04e45119b842b5b04f247dabd4156f48184921efed46adb109bfbeeacdfa5c3fe8095f63dd7574b7a4eed79170f1f836c8b5c287ff546a330e0af44d6d1a7dfd07f3fe4450c799a53b9a5693d3de0f3db07ba1dc92c5f93b325faa7ed8fb7686549fb311a75008c51804d71b510ee3ea420405a441200af6c7e3f5b80788768ac2658b458b4dfbf55d8dce05d2bdc450d33362ddc3f35ee5e7d3a5b59"}]})
syz_usb_control_io(r3, &(0x7f0000000540)={0x2c, &(0x7f0000000100)={0x20, 0x21, 0x29, {0x29, 0x1, "7d611870cced50a6dc9b9baae6e4fb07347310bcb53837f15d7c0201458010d302afc5dfce714d"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="000a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r2, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x0, 0x2, 0x87, {0x87, 0x4, "2d69d431c3064d0fb3a658130e712c9e939a1e2a6ad24640b3ce63280d19d811918f688f00ccbf2cbe19480b41ca3bdae78eaa4a542b5a7cfb1457d2805a520db803df2a3ab7b29dda8bcddceb3f00360908aaef3c3c73bbbbd561db8ae5f98c36a4f3793b0aaaea4fdb8383fd581f47a6628fa08e0f40665e82ab711ee2c6ac6451aab665"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc01}}}, &(0x7f0000000700)={0x44, &(0x7f0000000400)={0x40, 0x15, 0xfb, "04a87a25834acacccf46b8fff5c32eb534971baed3a20d78b328c3d1f608d86994816fcb2b6334b0c63516cea16a03b7b02bb06086ff45c0883834d22f7fa8da60ff09016c1daa00dc40952f5f1c2ba024769a5ffc706e6d4ff1a0874560aaa54f2737b883068a66f28e69e125d7bec48cbc59b5e794535f4d18aa4fc4010e9ee7f64bb3a72d81c9ceca4e050d70f9fe460c8337ce807b063fca726183b94b0b02c6e8d267d38f0e537dc61361336a3dbaca171b97eabc5b2fe353e9b7c7afb48e5c0fddb5c967cbbf8dfb85dc546cc30199212588b7f2ff4e6b8d3a8776b074c14859c183efc3f2b57c0550402476a98803116c93f20f233760a0"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x8a}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xe}, &(0x7f00000005c0)={0x20, 0x81, 0x3, "0192f7"}, &(0x7f0000000600)={0x20, 0x82, 0x1, "8a"}, &(0x7f0000000640)={0x20, 0x83, 0x3, "444615"}, &(0x7f0000000680)={0x20, 0x84, 0x2, "86a5"}, &(0x7f00000006c0)={0x20, 0x85, 0x3, "a3c87c"}})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c0014"], 0x184}, 0x1, 0xffffff80}, 0x0)
executing program 3:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r2], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r3 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000002100)=0xfff00000, 0x4)
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00')
lseek(r1, 0x2000, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd7000000000007f000001000000000000000000000000ac1414aa000000000000000000000100000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c2900"/229], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x5cf, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000, 0x8}, 0x0, 0xfffffffe, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8)
write(r3, 0x0, 0x0)
sendto$inet(r3, 0x0, 0x0, 0x0, 0x0, 0x0)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0)
capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40})
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, 0x0)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r4, 0x5386, 0x0)
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0)
write$binfmt_aout(r5, &(0x7f0000000380)=ANY=[], 0xff2e)
ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000140)={0x0, 0x4000000, 0xfffffff9, 0x7fff, 0x16, "0062ba7d82000000000000000000f7ffffff00"})
r6 = syz_open_pts(r5, 0xc0000)
ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000100)=0x12)
ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000000))
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32)
sendfile(r7, r7, 0x0, 0x1000)
getsockopt$MRT6(r7, 0x29, 0xce, &(0x7f0000000040), &(0x7f0000000080)=0x4)
executing program 3:
syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xaa, &(0x7f0000000800)=ANY=[]}]})
r0 = syz_usb_connect$uac2(0x2, 0xe7, &(0x7f0000000380)=ANY=[@ANYBLOB="12010003000000400c2018104000010203010902cc000301070009080b0100010b20000904000000010120000924010300085300050c240306040381060700000207240c02ee0305102402050402033d01a40000000507010f240d0200000401000100020002000f240d05010003010001000200010009240704020005022000090401010101022000092402010109022a0109050109200003070708250100009dff01090402000001022000090402010101022000102401060802038209100006050508250183000604000000000000000000000000479d3fc2f251d11f63eb734376d28ad4169414cf27f2bacb56383f1711ce83d25376397cf316c25ae376769d56ffff7f1cd1a416ac75be90721ff169fba1410d3d935b67fc65271f3bf58cbbf5c0b036cebfbce826137425ca43a39426fc65d14a4ba8fcec"], &(0x7f00000004c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x250, 0x1, 0x7, 0x1, 0x40, 0xa}, 0x0, 0x0})
mount$tmpfs(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6e725f696e6f6465733d652c00a9cebb7649d266ded5558ed12c4e0580e0a02cb338bb8b976751c7ea2693110667401722c0c29a692cd00f6682a86dd6717129d1cdb1ea57281e1c432ac8c36755cf44e83035af4131651b8f0535f16e11d6"])
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="200000005f000100080031000000000000000000", @ANYRES64=r1], 0x20}], 0x1, 0x0, 0x0, 0x4040040}, 0x20000000)
syz_usb_control_io$uac2(r0, &(0x7f00000008c0)={0x14, &(0x7f0000000580)={0x0, 0x22, 0x2, {0x2, 0x30}}, &(0x7f00000007c0)=ANY=[@ANYBLOB="00033a0000003a034ad8b76a0fdfdd8d38257df6ee30d8951584e20a5a0057fa22f51a5654c84520c4d0e2b017559cfc7fdac99cb500dc07f57574dc98e4d163"]}, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="cc010000100001000000000000000000ac1414aa0000000000000000000000000000000000000000000000000000000044030000000300030000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000000000000000000000100000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000002040000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000500000000000000000000000a000100000000000000000008002300f8ffffff480001"], 0x1cc}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000080), 0x3)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x11a, 0x4, 0x0, 0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r4, &(0x7f00000004c0)='./file1\x00', 0x5)
r5 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98)
fcntl$setlease(r5, 0x400, 0x1)
fcntl$setlease(r5, 0x400, 0x0)
sendto$inet6(r5, &(0x7f0000000280)="eec12b1100b5b76fbd1d7523e64c00ea23c7cf60ddd144d046449e4af00540b57be4b2513ae09640906433b88882cfaed02b82c533371c3eb0b602a82bb03a547dbe599b9ce4420bdbf2ef2d5873075bd596bd3dbb054c0423f7b0e59d303a3912327542de87c6569e879cc888ad49f0476bd14c647d90644a112b8bb728fbdaed4130a9ba2681704014e1d4ffc4938457392def16350291654980bab3f398058d7346c6eaccfdeef19f56c6981050be5bbb2514e1de62d49896ccdbadbe3c550746022c6988fe13dd14ca2282a18cfe40f05a3c476bb110a7c501d03b0b920ad3517a75", 0xe4, 0xd0, 0x0, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0x6a)
executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)
executing program 0:
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x40000104, 0x0, 0x9}]})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect$uac1(0x5, 0xaa, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ff00030100000009040000000101000002240100000002"], 0x0)
r5 = dup(r4)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000400)={0x24, &(0x7f0000000740)={0x40, 0xb, 0xfe, {0xfe, 0x30, "5b0ca40af96e7a62b850d07c96f6bced578d08fdfa89cffc990f37582b94045901a422d3f67a96c77d2f8b0a174ad268fe94bba1978faf619d79defb47348e62086633bb4322c9069162d1512e297a9741d846364891e2fcc1a92463c16ec4006992ab3700b680a78308eb683cc71ac1bd37bdad74dc1e3d5f54b83ce8a1b45a3fadbb5b9f9596bd798df737123036347de591a3799219922ca994868085cf25f4693a6899a75b776574a96d0c5b00f1ed05c808a432b8f54d4b77ba2cc8d12a77471be85bfebf59626444591e3551d988916901b009993f5ce5521c311fab7dcd2444c48b87288702b5ab6cdc0af796d792129eb1803741d883208f"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000000)=ANY=[], &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0xba, 0x1, {0x22, 0x70f}}}}, &(0x7f00000005c0)={0x2c, &(0x7f0000000440)={0x0, 0xa, 0x78, "c58e0253e33f099ce32240b3937f839b8e8b9ce258dccdfe32dd4fdcdc18c8a56a790d772d3b9ded78069fcd53d6e3a9849a806e7fa39e9f14234f8246fb908d298a79310fb1bd694da227b92d9d42f0f284358166c69c5c21682bae04a091dc70249b101c4c8347cf3dbd665c5e4cdb0f4220271f7bb0e6"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000000)={0x0, 0x8, 0x1, 0x5e}, &(0x7f0000000040)={0x20, 0x1, 0x3c, "c3fbb53d7d7e5d9086ae11f3e3fcd69aa07a05640bdc8a13c6cffd925f28f5b5e6b118a68522f324d19935cec5a7acde6346b9873ec3164d4900376f"}, &(0x7f0000000580)={0x20, 0x3, 0x1, 0x6}})
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r3, &(0x7f0000000600)=ANY=[@ANYBLOB="00008914bbbbbbbbbbbbaaaaaaaaaaaa88a83b008100100008060001080006040001000000000000ffffffff0180c20000010a0101021e173f3705ff78b60276b42b7f22edc2595fd8320dabd18e90d026df8a30b614b6f37554dc36ba869f47432bac215bf4de5de7b89ad1707eb551cc25a7d3da7a430feec84eda2e6a20bbdc2f7476d27163d5ae63d9aacf678059c7afcaf4c7f6bfa48be71c392585aca2de2bcd60013bd0c4c26bb910b443255eae3df3097185230c04a19623403c5e0f20c7dac9d616cc26e2088df883fabb2e6022bb095b69006f3af8e81034f1ea5f91325fefa52e3f79df90bb83447a8c088c07cc930cb5981dcec5f27947c89400868a6964692b008dd951916d931b9362acef961dca17dd30a685b8b52cffc0d33cec7b40d62e5f7ba449c80c1742ba"], 0x36)
syz_usb_connect(0x4, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000400000109021b0001110000000904000001"], 0x0)
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c0014"], 0x184}, 0x1, 0x80ffffffffffffff}, 0x0)
executing program 0:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r2], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 40, 2, 16, 7, 2, 16, 22, 23, 21, 2, 2, 5, 13, 2, 11]
detailed listing:
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7", @ANYRESDEC=r2], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_control_io$hid(r3, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r4 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 1:
socket$nl_generic(0x10, 0x3, 0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="417627bd7000fbdbdf2501000000000000000141000000140017000000ff"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x4080)
r2 = syz_open_dev$loop(&(0x7f0000000240), 0x41, 0x1c0862)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf) (async)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000040)={r3, 0x1000, {0x0, 0x0, 0x0, 0x1, 0x4000080000001001, 0x0, 0x0, 0x2, 0x1c, "faf98317e5a1149989958dbe53ea6accb396a2503dc3eb3fe37d58128bbad0099cebdc35f50160c9e6d6e3ab8588070000000000120000000000000000002200", "32d8cc26f70a000000000000009f3d9e234b30c5099fd3bcf409ff00ffff7bfe55cd4a5d83cd4a5249d3ffe70c7f3f800b2f1c6aa54cc50a1fcaed33ba1fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xffffffffff7ffcdf, 0x4]}})
sendfile(0xffffffffffffffff, r2, 0x0, 0x210) (async)
sendfile(0xffffffffffffffff, r2, 0x0, 0x210)
socket$netlink(0x10, 0x3, 0x13) (async)
r4 = socket$netlink(0x10, 0x3, 0x13)
r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0) (async)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0)
keyctl$get_keyring_id(0x0, 0x0, 0x4) (async)
keyctl$get_keyring_id(0x0, 0x0, 0x4)
writev(r4, 0x0, 0x0) (async)
writev(r4, 0x0, 0x0)
add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb) (async)
r6 = add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000008c0)={'syztnl1\x00', &(0x7f0000000a80)={'syztnl1\x00', <r7=>0x0, 0x8, 0x8000, 0x14bceff8, 0x3, {{0x30, 0x4, 0x2, 0x7, 0xc0, 0x65, 0x0, 0x2, 0x8e5235a2c1fec469, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x33, [@dev={0xac, 0x14, 0x14, 0x39}]}, @cipso={0x86, 0x5f, 0x1, [{0x1, 0x12, "3e46049840fde300000000ff8e5beb96"}, {0x6, 0x2}, {0x0, 0x6, "4ea04636"}, {0x6, 0xe, "fc37cdf7249016a9380cbded"}, {0x0, 0x12, "a3e42a93dce66aaa10fcbdf48ed4d6db"}, {0x2, 0x8, "a2b92bf6b4fa"}, {0x7, 0x5, "acade2"}, {0x7, 0x3, "c1"}, {0x5, 0xf, "1a789760ca1327a157681234c8"}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x40, 0x3, [{0x6459d8688415f9af, 0xc, "0b6cfae67bbd0fe9f722"}, {0x1, 0x12, "3aa8fe78a3af701eb2876c5cb4b635df"}, {0x0, 0xa, "3a3417fe169895bb"}, {0x0, 0x12, "99d58a1c51ca8eb370520c0609adab05"}]}]}}}}})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async)
r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
read(r8, 0x0, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f00000009c0)={&(0x7f0000000780), 0xc, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c000000140008002cbd7000fcdbdf250a010102000000000000000000000000fc0000000000000000000000000000014e201d5d4e2400000a00800050000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYBLOB="bc6b6e0002000000000000000000350006000000"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000)
r9 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$search(0xa, r6, &(0x7f0000000300)='logon\x00', &(0x7f0000000340)={'syz', 0x3}, r9)
r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000680), r4)
sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0500000000000000df251c00000014b700000000000000ffffff0200000000000000040005009f47a841a2b4f4fa71f982edf5d465e1ead2a59070cf2815603f1fb5b36c922b136ebe79c06223135ce52ab88ff96d0d27c32fa8103531dfb31bd51933a8e17340a960761b95"], 0x2c}}, 0x40000)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]}) (async)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]})
writev(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1)
r14 = socket$nl_generic(0x10, 0x3, 0x10)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r4)
sendmsg$NL80211_CMD_GET_KEY(r14, &(0x7f0000000600)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r15, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "6d9ae3b6e593573daf174c0777"}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x805}, 0x4000)
keyctl$unlink(0x9, r9, 0xffffffffffffffff)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
sendmsg$key(0xffffffffffffffff, 0x0, 0x40000)
ioctl(0xffffffffffffffff, 0x8b32, 0x0)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1201000000000010580413500000000000010902240001000050000904000081030000000921faff000122a00009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="4023a0"], 0x0, 0x0, 0x0, 0x0}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/185)
executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2c000010)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x82482, 0x0)
read(r0, &(0x7f0000000140)=""/69, 0x45)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001380), 0x200, 0x0)
ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd92) (async)
fcntl$setflags(r1, 0x2, 0x0) (async)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) (async)
listen(r2, 0x5)
syz_open_procfs(0xffffffffffffffff, 0x0) (async)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x24040014, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) (async)
close_range(r2, 0xffffffffffffffff, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x5)
executing program 2:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586b3"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x20000)
r1 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00')
preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000280)=""/200, 0xc8}], 0x1, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000040)={0x1, 0x3, 0x7ff})
r2 = socket$inet(0x2, 0x801, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10)
r3 = dup2(r2, r2)
r4 = socket(0x1e, 0x1, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0x5d, {0x5d, 0xb, "bac36109b815a9ed6cffb9e868471d1853ffbf40560129f7d3b1fa4404e360ba50a9f820085f4305d5066cb6d3e952a73fb6ce92c51386aeff9324b66eb1e1524bfd4f502a533017e11e8bb2cfcaef69605baa9ecee4f254e3a389"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f00000002c0)={0x0, 0xf, 0x71, {0x5, 0xf, 0x71, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0xe, "a2c0ed7c1b5d5bf555b26fb5258c5981"}, @generic={0x58, 0x10, 0x2, "27f537102841e3f1ae1a5f70d0a41bdecec3e8d46fe8a03770e331348d944e858da47fecabf5295d87f0284d487909316322348818fe397ec9b9f59c8786cfe7352e64a9ef0a88916aad9e11276a5b6f902c795dab"}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x10, 0x2, 0x40, "43b85e46", "5d1d771a"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x70, 0x0, 0x2, 0x0, 0x6, 0x4}}}, &(0x7f0000000900)={0x84, &(0x7f0000000440)={0x0, 0x1d, 0xd8, "382628524a9c776e0369f61c0a37c6db1976f47cb8fbec4d5896cd473e70052394ec58dd5d46e114826d4d06ecd78560ccd28860167906566ec25a21a2d3a6782bdac0a4c0cc37aa9da66a2aedb5f2e6799bb8f45f64dcaeee146b9b96150c5c9f63239dd49a75f211d19c6166e0ff0d4356f2da812b5b352e8406036d749863bb41dbf58c18cbbac887fc380500557dec94e611a9fefb7756941f2fae49700f38b0db75b8e00a66d2f5361e5868e1dca65f381a00ee4621c1be723dd1ae637a36bcccd949fa242e66154d98fb2416aa8b91045f05a80528"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000580)={0x0, 0x8, 0x1}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1c00, 0x353a11e0a97a2837}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xd}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "b317"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0x9596}, &(0x7f0000000740)={0x40, 0x13, 0x6}, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "9ffb"}, &(0x7f0000000800)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x1c, 0x1, 0xf3}, &(0x7f0000000880)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000008c0)={0x40, 0x21, 0x1, 0x16}})
setsockopt(r4, 0x7, 0x6, &(0x7f0000000000)="31edf7616e511ddd92b014d6c7bd2a1367af2d1b193eb80402172c7174407a891bdc4993dc6a5d36f7281659325d778930", 0x31)
pipe2(&(0x7f0000000100)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x0)
r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f00000019c0)={0x2020}, 0x2020)
splice(r3, 0x0, r5, 0x0, 0x40, 0xb)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={<r7=>0x0})
r8 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f00000001c0)={r7, 0x2, r0, 0x1, 0x80000})
ioctl$HIDIOCGNAME(r0, 0x80404806, &(0x7f00000000c0))
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0)
capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40})
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, 0x0)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x88000, 0x0)
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r4, 0x5386, 0x0)
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0)
write$binfmt_aout(r5, &(0x7f0000000380)=ANY=[], 0xff2e)
ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000140)={0x0, 0x4000000, 0xfffffff9, 0x7fff, 0x16, "0062ba7d82000000000000000000f7ffffff00"})
r6 = syz_open_pts(r5, 0xc0000)
ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000100)=0x12)
ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000000))
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32)
sendfile(r7, r7, 0x0, 0x1000)
getsockopt$MRT6(r7, 0x29, 0xce, &(0x7f0000000040), &(0x7f0000000080)=0x4)
executing program 3:
syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xaa, &(0x7f0000000800)=ANY=[]}]})
r0 = syz_usb_connect$uac2(0x2, 0xe7, &(0x7f0000000380)=ANY=[@ANYBLOB="12010003000000400c2018104000010203010902cc000301070009080b0100010b20000904000000010120000924010300085300050c240306040381060700000207240c02ee0305102402050402033d01a40000000507010f240d0200000401000100020002000f240d05010003010001000200010009240704020005022000090401010101022000092402010109022a0109050109200003070708250100009dff01090402000001022000090402010101022000102401060802038209100006050508250183000604000000000000000000000000479d3fc2f251d11f63eb734376d28ad4169414cf27f2bacb56383f1711ce83d25376397cf316c25ae376769d56ffff7f1cd1a416ac75be90721ff169fba1410d3d935b67fc65271f3bf58cbbf5c0b036cebfbce826137425ca43a39426fc65d14a4ba8fcec"], &(0x7f00000004c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x250, 0x1, 0x7, 0x1, 0x40, 0xa}, 0x0, 0x0})
mount$tmpfs(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6e725f696e6f6465733d652c00a9cebb7649d266ded5558ed12c4e0580e0a02cb338bb8b976751c7ea2693110667401722c0c29a692cd00f6682a86dd6717129d1cdb1ea57281e1c432ac8c36755cf44e83035af4131651b8f0535f16e11d6"])
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="200000005f000100080031000000000000000000", @ANYRES64=r1], 0x20}], 0x1, 0x0, 0x0, 0x4040040}, 0x20000000)
syz_usb_control_io$uac2(r0, &(0x7f00000008c0)={0x14, &(0x7f0000000580)={0x0, 0x22, 0x2, {0x2, 0x30}}, &(0x7f00000007c0)=ANY=[@ANYBLOB="00033a0000003a034ad8b76a0fdfdd8d38257df6ee30d8951584e20a5a0057fa22f51a5654c84520c4d0e2b017559cfc7fdac99cb500dc07f57574dc98e4d163"]}, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="cc010000100001000000000000000000ac1414aa0000000000000000000000000000000000000000000000000000000044030000000300030000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000000000000000000000100000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000002040000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000500000000000000000000000a000100000000000000000008002300f8ffffff480001"], 0x1cc}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2042, 0x19d)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000080), 0x3)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x11a, 0x4, 0x0, 0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r4, &(0x7f00000004c0)='./file1\x00', 0x5)
r5 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98)
fcntl$setlease(r5, 0x400, 0x1)
fcntl$setlease(r5, 0x400, 0x0)
sendto$inet6(r5, &(0x7f0000000280)="eec12b1100b5b76fbd1d7523e64c00ea23c7cf60ddd144d046449e4af00540b57be4b2513ae09640906433b88882cfaed02b82c533371c3eb0b602a82bb03a547dbe599b9ce4420bdbf2ef2d5873075bd596bd3dbb054c0423f7b0e59d303a3912327542de87c6569e879cc888ad49f0476bd14c647d90644a112b8bb728fbdaed4130a9ba2681704014e1d4ffc4938457392def16350291654980bab3f398058d7346c6eaccfdeef19f56c6981050be5bbb2514e1de62d49896ccdbadbe3c550746022c6988fe13dd14ca2282a18cfe40f05a3c476bb110a7c501d03b0b920ad3517a75", 0xe4, 0xd0, 0x0, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0x6a)
executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)
executing program 0:
memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x40000104, 0x0, 0x9}]})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect$uac1(0x5, 0xaa, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ff00030100000009040000000101000002240100000002"], 0x0)
r5 = dup(r4)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000400)={0x24, &(0x7f0000000740)={0x40, 0xb, 0xfe, {0xfe, 0x30, "5b0ca40af96e7a62b850d07c96f6bced578d08fdfa89cffc990f37582b94045901a422d3f67a96c77d2f8b0a174ad268fe94bba1978faf619d79defb47348e62086633bb4322c9069162d1512e297a9741d846364891e2fcc1a92463c16ec4006992ab3700b680a78308eb683cc71ac1bd37bdad74dc1e3d5f54b83ce8a1b45a3fadbb5b9f9596bd798df737123036347de591a3799219922ca994868085cf25f4693a6899a75b776574a96d0c5b00f1ed05c808a432b8f54d4b77ba2cc8d12a77471be85bfebf59626444591e3551d988916901b009993f5ce5521c311fab7dcd2444c48b87288702b5ab6cdc0af796d792129eb1803741d883208f"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000000)=ANY=[], &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0xba, 0x1, {0x22, 0x70f}}}}, &(0x7f00000005c0)={0x2c, &(0x7f0000000440)={0x0, 0xa, 0x78, "c58e0253e33f099ce32240b3937f839b8e8b9ce258dccdfe32dd4fdcdc18c8a56a790d772d3b9ded78069fcd53d6e3a9849a806e7fa39e9f14234f8246fb908d298a79310fb1bd694da227b92d9d42f0f284358166c69c5c21682bae04a091dc70249b101c4c8347cf3dbd665c5e4cdb0f4220271f7bb0e6"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000000)={0x0, 0x8, 0x1, 0x5e}, &(0x7f0000000040)={0x20, 0x1, 0x3c, "c3fbb53d7d7e5d9086ae11f3e3fcd69aa07a05640bdc8a13c6cffd925f28f5b5e6b118a68522f324d19935cec5a7acde6346b9873ec3164d4900376f"}, &(0x7f0000000580)={0x20, 0x3, 0x1, 0x6}})
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r3, &(0x7f0000000600)=ANY=[@ANYBLOB="00008914bbbbbbbbbbbbaaaaaaaaaaaa88a83b008100100008060001080006040001000000000000ffffffff0180c20000010a0101021e173f3705ff78b60276b42b7f22edc2595fd8320dabd18e90d026df8a30b614b6f37554dc36ba869f47432bac215bf4de5de7b89ad1707eb551cc25a7d3da7a430feec84eda2e6a20bbdc2f7476d27163d5ae63d9aacf678059c7afcaf4c7f6bfa48be71c392585aca2de2bcd60013bd0c4c26bb910b443255eae3df3097185230c04a19623403c5e0f20c7dac9d616cc26e2088df883fabb2e6022bb095b69006f3af8e81034f1ea5f91325fefa52e3f79df90bb83447a8c088c07cc930cb5981dcec5f27947c89400868a6964692b008dd951916d931b9362acef961dca17dd30a685b8b52cffc0d33cec7b40d62e5f7ba449c80c1742ba"], 0x36)
syz_usb_connect(0x4, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000400000109021b0001110000000904000001"], 0x0)
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe80000000000000000000a6109ce800000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c0014"], 0x184}, 0x1, 0x80ffffffffffffff}, 0x0)
executing program 0:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r2], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)

program crashed: WARNING in untrack_pfn
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 40, 2, 16, 7, 2, 16, 22, 2]
detailed listing:
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7", @ANYRESDEC=r2], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_control_io$hid(r3, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r4 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 1:
socket$nl_generic(0x10, 0x3, 0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="417627bd7000fbdbdf2501000000000000000141000000140017000000ff"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x4080)
r2 = syz_open_dev$loop(&(0x7f0000000240), 0x41, 0x1c0862)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf) (async)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000040)={r3, 0x1000, {0x0, 0x0, 0x0, 0x1, 0x4000080000001001, 0x0, 0x0, 0x2, 0x1c, "faf98317e5a1149989958dbe53ea6accb396a2503dc3eb3fe37d58128bbad0099cebdc35f50160c9e6d6e3ab8588070000000000120000000000000000002200", "32d8cc26f70a000000000000009f3d9e234b30c5099fd3bcf409ff00ffff7bfe55cd4a5d83cd4a5249d3ffe70c7f3f800b2f1c6aa54cc50a1fcaed33ba1fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xffffffffff7ffcdf, 0x4]}})
sendfile(0xffffffffffffffff, r2, 0x0, 0x210) (async)
sendfile(0xffffffffffffffff, r2, 0x0, 0x210)
socket$netlink(0x10, 0x3, 0x13) (async)
r4 = socket$netlink(0x10, 0x3, 0x13)
r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0) (async)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0)
keyctl$get_keyring_id(0x0, 0x0, 0x4) (async)
keyctl$get_keyring_id(0x0, 0x0, 0x4)
writev(r4, 0x0, 0x0) (async)
writev(r4, 0x0, 0x0)
add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb) (async)
r6 = add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000008c0)={'syztnl1\x00', &(0x7f0000000a80)={'syztnl1\x00', <r7=>0x0, 0x8, 0x8000, 0x14bceff8, 0x3, {{0x30, 0x4, 0x2, 0x7, 0xc0, 0x65, 0x0, 0x2, 0x8e5235a2c1fec469, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x33, [@dev={0xac, 0x14, 0x14, 0x39}]}, @cipso={0x86, 0x5f, 0x1, [{0x1, 0x12, "3e46049840fde300000000ff8e5beb96"}, {0x6, 0x2}, {0x0, 0x6, "4ea04636"}, {0x6, 0xe, "fc37cdf7249016a9380cbded"}, {0x0, 0x12, "a3e42a93dce66aaa10fcbdf48ed4d6db"}, {0x2, 0x8, "a2b92bf6b4fa"}, {0x7, 0x5, "acade2"}, {0x7, 0x3, "c1"}, {0x5, 0xf, "1a789760ca1327a157681234c8"}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x40, 0x3, [{0x6459d8688415f9af, 0xc, "0b6cfae67bbd0fe9f722"}, {0x1, 0x12, "3aa8fe78a3af701eb2876c5cb4b635df"}, {0x0, 0xa, "3a3417fe169895bb"}, {0x0, 0x12, "99d58a1c51ca8eb370520c0609adab05"}]}]}}}}})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async)
r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
read(r8, 0x0, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f00000009c0)={&(0x7f0000000780), 0xc, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c000000140008002cbd7000fcdbdf250a010102000000000000000000000000fc0000000000000000000000000000014e201d5d4e2400000a00800050000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYBLOB="bc6b6e0002000000000000000000350006000000"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000)
r9 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$search(0xa, r6, &(0x7f0000000300)='logon\x00', &(0x7f0000000340)={'syz', 0x3}, r9)
r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000680), r4)
sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0500000000000000df251c00000014b700000000000000ffffff0200000000000000040005009f47a841a2b4f4fa71f982edf5d465e1ead2a59070cf2815603f1fb5b36c922b136ebe79c06223135ce52ab88ff96d0d27c32fa8103531dfb31bd51933a8e17340a960761b95"], 0x2c}}, 0x40000)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]}) (async)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]})
writev(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1)
r14 = socket$nl_generic(0x10, 0x3, 0x10)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r4)
sendmsg$NL80211_CMD_GET_KEY(r14, &(0x7f0000000600)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r15, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "6d9ae3b6e593573daf174c0777"}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x805}, 0x4000)
keyctl$unlink(0x9, r9, 0xffffffffffffffff)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
sendmsg$key(0xffffffffffffffff, 0x0, 0x40000)
ioctl(0xffffffffffffffff, 0x8b32, 0x0)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1201000000000010580413500000000000010902240001000050000904000081030000000921faff000122a00009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="4023a0"], 0x0, 0x0, 0x0, 0x0}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/185)
executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2c000010)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x82482, 0x0)
read(r0, &(0x7f0000000140)=""/69, 0x45)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001380), 0x200, 0x0)
ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd92) (async)
fcntl$setflags(r1, 0x2, 0x0) (async)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) (async)
listen(r2, 0x5)
syz_open_procfs(0xffffffffffffffff, 0x0) (async)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x24040014, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) (async)
close_range(r2, 0xffffffffffffffff, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x5)
executing program 2:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586b3"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x20000)
r1 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00')
preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000280)=""/200, 0xc8}], 0x1, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000040)={0x1, 0x3, 0x7ff})
r2 = socket$inet(0x2, 0x801, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10)
r3 = dup2(r2, r2)
r4 = socket(0x1e, 0x1, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0x5d, {0x5d, 0xb, "bac36109b815a9ed6cffb9e868471d1853ffbf40560129f7d3b1fa4404e360ba50a9f820085f4305d5066cb6d3e952a73fb6ce92c51386aeff9324b66eb1e1524bfd4f502a533017e11e8bb2cfcaef69605baa9ecee4f254e3a389"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f00000002c0)={0x0, 0xf, 0x71, {0x5, 0xf, 0x71, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0xe, "a2c0ed7c1b5d5bf555b26fb5258c5981"}, @generic={0x58, 0x10, 0x2, "27f537102841e3f1ae1a5f70d0a41bdecec3e8d46fe8a03770e331348d944e858da47fecabf5295d87f0284d487909316322348818fe397ec9b9f59c8786cfe7352e64a9ef0a88916aad9e11276a5b6f902c795dab"}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x10, 0x2, 0x40, "43b85e46", "5d1d771a"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x70, 0x0, 0x2, 0x0, 0x6, 0x4}}}, &(0x7f0000000900)={0x84, &(0x7f0000000440)={0x0, 0x1d, 0xd8, "382628524a9c776e0369f61c0a37c6db1976f47cb8fbec4d5896cd473e70052394ec58dd5d46e114826d4d06ecd78560ccd28860167906566ec25a21a2d3a6782bdac0a4c0cc37aa9da66a2aedb5f2e6799bb8f45f64dcaeee146b9b96150c5c9f63239dd49a75f211d19c6166e0ff0d4356f2da812b5b352e8406036d749863bb41dbf58c18cbbac887fc380500557dec94e611a9fefb7756941f2fae49700f38b0db75b8e00a66d2f5361e5868e1dca65f381a00ee4621c1be723dd1ae637a36bcccd949fa242e66154d98fb2416aa8b91045f05a80528"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000580)={0x0, 0x8, 0x1}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1c00, 0x353a11e0a97a2837}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xd}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "b317"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0x9596}, &(0x7f0000000740)={0x40, 0x13, 0x6}, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "9ffb"}, &(0x7f0000000800)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x1c, 0x1, 0xf3}, &(0x7f0000000880)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000008c0)={0x40, 0x21, 0x1, 0x16}})
setsockopt(r4, 0x7, 0x6, &(0x7f0000000000)="31edf7616e511ddd92b014d6c7bd2a1367af2d1b193eb80402172c7174407a891bdc4993dc6a5d36f7281659325d778930", 0x31)
pipe2(&(0x7f0000000100)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x0)
r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f00000019c0)={0x2020}, 0x2020)
splice(r3, 0x0, r5, 0x0, 0x40, 0xb)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={<r7=>0x0})
r8 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f00000001c0)={r7, 0x2, r0, 0x1, 0x80000})
ioctl$HIDIOCGNAME(r0, 0x80404806, &(0x7f00000000c0))
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 2, 16, 22, 2]
detailed listing:
executing program 1:
sendmsg$key(0xffffffffffffffff, 0x0, 0x40000)
ioctl(0xffffffffffffffff, 0x8b32, 0x0)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000b40)=ANY=[@ANYBLOB="1201000000000010580413500000000000010902240001000050000904000081030000000921faff000122a00009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="4023a0"], 0x0, 0x0, 0x0, 0x0}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/185)
executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2c000010)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x82482, 0x0)
read(r0, &(0x7f0000000140)=""/69, 0x45)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001380), 0x200, 0x0)
ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd92) (async)
fcntl$setflags(r1, 0x2, 0x0) (async)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) (async)
listen(r2, 0x5)
syz_open_procfs(0xffffffffffffffff, 0x0) (async)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x24040014, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) (async)
close_range(r2, 0xffffffffffffffff, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x5)
executing program 2:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586b3"], 0x0}, 0x0)
r0 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x20000)
r1 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00')
preadv(r1, &(0x7f0000000500)=[{&(0x7f0000000280)=""/200, 0xc8}], 0x1, 0x3, 0x0)
ioctl$HIDIOCSREPORT(r0, 0x400c4808, &(0x7f0000000040)={0x1, 0x3, 0x7ff})
r2 = socket$inet(0x2, 0x801, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10)
r3 = dup2(r2, r2)
r4 = socket(0x1e, 0x1, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0x5d, {0x5d, 0xb, "bac36109b815a9ed6cffb9e868471d1853ffbf40560129f7d3b1fa4404e360ba50a9f820085f4305d5066cb6d3e952a73fb6ce92c51386aeff9324b66eb1e1524bfd4f502a533017e11e8bb2cfcaef69605baa9ecee4f254e3a389"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f00000002c0)={0x0, 0xf, 0x71, {0x5, 0xf, 0x71, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0xe, "a2c0ed7c1b5d5bf555b26fb5258c5981"}, @generic={0x58, 0x10, 0x2, "27f537102841e3f1ae1a5f70d0a41bdecec3e8d46fe8a03770e331348d944e858da47fecabf5295d87f0284d487909316322348818fe397ec9b9f59c8786cfe7352e64a9ef0a88916aad9e11276a5b6f902c795dab"}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x10, 0x2, 0x40, "43b85e46", "5d1d771a"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x70, 0x0, 0x2, 0x0, 0x6, 0x4}}}, &(0x7f0000000900)={0x84, &(0x7f0000000440)={0x0, 0x1d, 0xd8, "382628524a9c776e0369f61c0a37c6db1976f47cb8fbec4d5896cd473e70052394ec58dd5d46e114826d4d06ecd78560ccd28860167906566ec25a21a2d3a6782bdac0a4c0cc37aa9da66a2aedb5f2e6799bb8f45f64dcaeee146b9b96150c5c9f63239dd49a75f211d19c6166e0ff0d4356f2da812b5b352e8406036d749863bb41dbf58c18cbbac887fc380500557dec94e611a9fefb7756941f2fae49700f38b0db75b8e00a66d2f5361e5868e1dca65f381a00ee4621c1be723dd1ae637a36bcccd949fa242e66154d98fb2416aa8b91045f05a80528"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000580)={0x0, 0x8, 0x1}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1c00, 0x353a11e0a97a2837}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xd}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "b317"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0x9596}, &(0x7f0000000740)={0x40, 0x13, 0x6}, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f00000007c0)={0x40, 0x19, 0x2, "9ffb"}, &(0x7f0000000800)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x1c, 0x1, 0xf3}, &(0x7f0000000880)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000008c0)={0x40, 0x21, 0x1, 0x16}})
setsockopt(r4, 0x7, 0x6, &(0x7f0000000000)="31edf7616e511ddd92b014d6c7bd2a1367af2d1b193eb80402172c7174407a891bdc4993dc6a5d36f7281659325d778930", 0x31)
pipe2(&(0x7f0000000100)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x0)
r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0)
read$FUSE(r6, &(0x7f00000019c0)={0x2020}, 0x2020)
splice(r3, 0x0, r5, 0x0, 0x40, 0xb)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={<r7=>0x0})
r8 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f00000001c0)={r7, 0x2, r0, 0x1, 0x80000})
ioctl$HIDIOCGNAME(r0, 0x80404806, &(0x7f00000000c0))
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 40, 2, 16, 2]
detailed listing:
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'macvlan1\x00', 0xfd2})
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0xfc, 0x2, 0x6}, {0x35, 0x1, 0x0, 0x1}, {0x2, 0x4}, {0x6, 0x2, 0x0, 0x1ff}]})
ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x5}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x7}, {0x8000, 0x0, 0xfffd}, {0x400, 0x0, 0x10000009}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x9}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x9f12}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x1000000000004}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0)
r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7", @ANYRESDEC=r2], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_control_io$hid(r3, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00220f000000b01b455061479e3d754b819afc860cdd847847d469fdd6b3414ba7e480dd996a2a1a84d95b099e63fca359b16d83bf21fa8e8c45ef87e76664cf5c3fc7a7bb8b1d9518e50690634f0da3975c7c49bd72980c80e99f39b171ca"], 0x0}, 0x0)
r4 = syz_open_dev$hiddev(&(0x7f0000000180), 0x0, 0x2040)
ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000040)={0x3, 0x200, 0x7ff})
executing program 1:
socket$nl_generic(0x10, 0x3, 0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="417627bd7000fbdbdf2501000000000000000141000000140017000000ff"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x4080)
r2 = syz_open_dev$loop(&(0x7f0000000240), 0x41, 0x1c0862)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf) (async)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x82843, 0xf)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000040)={r3, 0x1000, {0x0, 0x0, 0x0, 0x1, 0x4000080000001001, 0x0, 0x0, 0x2, 0x1c, "faf98317e5a1149989958dbe53ea6accb396a2503dc3eb3fe37d58128bbad0099cebdc35f50160c9e6d6e3ab8588070000000000120000000000000000002200", "32d8cc26f70a000000000000009f3d9e234b30c5099fd3bcf409ff00ffff7bfe55cd4a5d83cd4a5249d3ffe70c7f3f800b2f1c6aa54cc50a1fcaed33ba1fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xffffffffff7ffcdf, 0x4]}})
sendfile(0xffffffffffffffff, r2, 0x0, 0x210) (async)
sendfile(0xffffffffffffffff, r2, 0x0, 0x210)
socket$netlink(0x10, 0x3, 0x13) (async)
r4 = socket$netlink(0x10, 0x3, 0x13)
r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0) (async)
pidfd_send_signal(r5, 0x33, &(0x7f0000000000)={0x11, 0x4, 0x2}, 0x0)
keyctl$get_keyring_id(0x0, 0x0, 0x4) (async)
keyctl$get_keyring_id(0x0, 0x0, 0x4)
writev(r4, 0x0, 0x0) (async)
writev(r4, 0x0, 0x0)
add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb) (async)
r6 = add_key$fscrypt_provisioning(&(0x7f0000000400), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000065666768696a6b6c6d6e6f707172737475767778797a303132333435360e04b5d793ac0ecc1c6e310cf2dd259415c3c6db363bb6495d9bc06aee8bedae452427826f0d50a7b3c08d913acd17f1c0d7445e8b57717795bac71a08c8d26d74cfee4aab001110a6b502db94b0d021184271e10a821b6ff0e8de294eca49cec1e5acf425f9c490f79272983c2a2ede342f798c6d7d43917041374dd4fc8f176fc17be6d66b5542b5221a55995fd333f10915822444981c5600"/202], 0x29, 0xfffffffffffffffb)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000008c0)={'syztnl1\x00', &(0x7f0000000a80)={'syztnl1\x00', <r7=>0x0, 0x8, 0x8000, 0x14bceff8, 0x3, {{0x30, 0x4, 0x2, 0x7, 0xc0, 0x65, 0x0, 0x2, 0x8e5235a2c1fec469, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0x33, [@dev={0xac, 0x14, 0x14, 0x39}]}, @cipso={0x86, 0x5f, 0x1, [{0x1, 0x12, "3e46049840fde300000000ff8e5beb96"}, {0x6, 0x2}, {0x0, 0x6, "4ea04636"}, {0x6, 0xe, "fc37cdf7249016a9380cbded"}, {0x0, 0x12, "a3e42a93dce66aaa10fcbdf48ed4d6db"}, {0x2, 0x8, "a2b92bf6b4fa"}, {0x7, 0x5, "acade2"}, {0x7, 0x3, "c1"}, {0x5, 0xf, "1a789760ca1327a157681234c8"}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x40, 0x3, [{0x6459d8688415f9af, 0xc, "0b6cfae67bbd0fe9f722"}, {0x1, 0x12, "3aa8fe78a3af701eb2876c5cb4b635df"}, {0x0, 0xa, "3a3417fe169895bb"}, {0x0, 0x12, "99d58a1c51ca8eb370520c0609adab05"}]}]}}}}})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async)
r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
read(r8, 0x0, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f00000009c0)={&(0x7f0000000780), 0xc, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c000000140008002cbd7000fcdbdf250a010102000000000000000000000000fc0000000000000000000000000000014e201d5d4e2400000a00800050000000", @ANYRES32=r7, @ANYRES32=0x0, @ANYBLOB="bc6b6e0002000000000000000000350006000000"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000)
r9 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$search(0xa, r6, &(0x7f0000000300)='logon\x00', &(0x7f0000000340)={'syz', 0x3}, r9)
r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000680), r4)
sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0500000000000000df251c00000014b700000000000000ffffff0200000000000000040005009f47a841a2b4f4fa71f982edf5d465e1ead2a59070cf2815603f1fb5b36c922b136ebe79c06223135ce52ab88ff96d0d27c32fa8103531dfb31bd51933a8e17340a960761b95"], 0x2c}}, 0x40000)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]}) (async)
ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0xfffffffffffffffd}]})
writev(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1)
r14 = socket$nl_generic(0x10, 0x3, 0x10)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r4)
sendmsg$NL80211_CMD_GET_KEY(r14, &(0x7f0000000600)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x40, r15, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "6d9ae3b6e593573daf174c0777"}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x805}, 0x4000)
keyctl$unlink(0x9, r9, 0xffffffffffffffff)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 16, 2]
detailed listing:
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 2]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00')
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000080)='./file0\x00') (async)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
read(r4, 0x0, 0x0) (async, rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
inotify_rm_watch(r5, 0x0) (async, rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
syz_open_procfs(0x0, &(0x7f0000000180)='coredump_filter\x00')
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
unshare(0x22020600) (async)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
r4 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$selinux_user(r4, 0x0, 0x27) (async)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x8040, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) (rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000680)) (async, rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x26e, 0x0, 0x7fff}]}) (async)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2]
detailed listing:
executing program 0:
executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
minimized 16 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
executing program 0:
syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
executing program 0:
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, 0xffffffffffffffff, 0x0) (fail_nth: 10)

program did not crash
minimized 2 calls -> 2 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 64)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, 0xffffffffffffffff, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (async, rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(0x0, 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
program crashed: WARNING in corrupted
a never seen crash title: WARNING in corrupted, ignore
simplifying guilty program options
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program did not crash
validation run: crashed=false
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
validation run: crashed=true
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
validation run: crashed=true
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$usbfs-mmap
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0) (rerun: 64)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000b07000/0x2000)=nil, 0x2000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 10)

program crashed: WARNING in untrack_pfn
validation run: crashed=true
reproducing took 37m3.946002537s
repro crashed as (corrupted=false):
WARNING: CPU: 1 PID: 414 at arch/x86/mm/pat/memtype.c:983 get_pat_info arch/x86/mm/pat/memtype.c:983 [inline]
WARNING: CPU: 1 PID: 414 at arch/x86/mm/pat/memtype.c:983 untrack_pfn+0x4cb/0x5c0 arch/x86/mm/pat/memtype.c:1098
Modules linked in:

CPU: 1 UID: 0 PID: 414 Comm: syz.1.25 Not tainted syzkaller #0 68e3201df5fdad0ba521b4874bccf43aba0ac9cd
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:get_pat_info arch/x86/mm/pat/memtype.c:983 [inline]
RIP: 0010:untrack_pfn+0x4cb/0x5c0 arch/x86/mm/pat/memtype.c:1098
Code: f8 f8 45 85 f6 0f 84 ab 00 00 00 e8 4f 9e 40 00 4c 8b 74 24 10 4d 85 f6 0f 85 b7 fe ff ff e8 3c 9e 40 00 eb 47 e8 35 9e 40 00 <0f> 0b 49 bd 00 00 00 00 00 fc ff df eb 34 e8 22 9e 40 00 4c 8b 7c
RSP: 0018:ffffc900011cf2e0 EFLAGS: 00010293
RAX: ffffffff8146d3bb RBX: 1ffff92000239e60 RCX: ffff888118832600
RDX: 0000000000000000 RSI: 0000000000000028 RDI: 0000000000000020
RBP: ffffc900011cf3f0 R08: ffffc900011cf377 R09: 0000000000000000
R10: ffffc900011cf350 R11: fffff52000239e6f R12: ffffc900011cf340
R13: 1ffff11022f62368 R14: 0000000000000028 R15: 0000000000000000
FS:  00007fa5dffeb6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1880587000 CR3: 0000000117ebe000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 unmap_single_vma mm/memory.c:1940 [inline]
 zap_page_range_single+0x4ce/0x4e0 mm/memory.c:2041

final repro crashed as (corrupted=false):
WARNING: CPU: 1 PID: 414 at arch/x86/mm/pat/memtype.c:983 get_pat_info arch/x86/mm/pat/memtype.c:983 [inline]
WARNING: CPU: 1 PID: 414 at arch/x86/mm/pat/memtype.c:983 untrack_pfn+0x4cb/0x5c0 arch/x86/mm/pat/memtype.c:1098
Modules linked in:

CPU: 1 UID: 0 PID: 414 Comm: syz.1.25 Not tainted syzkaller #0 68e3201df5fdad0ba521b4874bccf43aba0ac9cd
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:get_pat_info arch/x86/mm/pat/memtype.c:983 [inline]
RIP: 0010:untrack_pfn+0x4cb/0x5c0 arch/x86/mm/pat/memtype.c:1098
Code: f8 f8 45 85 f6 0f 84 ab 00 00 00 e8 4f 9e 40 00 4c 8b 74 24 10 4d 85 f6 0f 85 b7 fe ff ff e8 3c 9e 40 00 eb 47 e8 35 9e 40 00 <0f> 0b 49 bd 00 00 00 00 00 fc ff df eb 34 e8 22 9e 40 00 4c 8b 7c
RSP: 0018:ffffc900011cf2e0 EFLAGS: 00010293
RAX: ffffffff8146d3bb RBX: 1ffff92000239e60 RCX: ffff888118832600
RDX: 0000000000000000 RSI: 0000000000000028 RDI: 0000000000000020
RBP: ffffc900011cf3f0 R08: ffffc900011cf377 R09: 0000000000000000
R10: ffffc900011cf350 R11: fffff52000239e6f R12: ffffc900011cf340
R13: 1ffff11022f62368 R14: 0000000000000028 R15: 0000000000000000
FS:  00007fa5dffeb6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1880587000 CR3: 0000000117ebe000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 unmap_single_vma mm/memory.c:1940 [inline]
 zap_page_range_single+0x4ce/0x4e0 mm/memory.c:2041