Extracting prog: 17m36.270073714s
Minimizing prog: 34m42.667206568s
Simplifying prog options: 0s
Extracting C: 49.088741029s
Simplifying C: 9m25.302699683s


extracting reproducer from 36 programs
testing a last program of every proc
single: executing 6 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-close-openat$ubi_ctrl-ioctl-close-nanosleep-openat-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24)
close(r2)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r3)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-read
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dbg/bluetooth/l2cap\x00', 0x0, 0x0)
read(r0, &(0x7f0000000700)=""/1024, 0x400)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write-nanosleep
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-readlinkat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/drivers/maxtcpc/0-0022\x00', &(0x7f0000000400)=""/256, 0x100)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-nanosleep-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_IP
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd26, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x4)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, r2, 0x3e8}}, 0x48)

program did not crash
single: failed to extract reproducer
bisect: bisecting 36 programs with base timeout 30s
testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6, 24, 16, 14, 6, 2, 13, 12, 21, 15, 12, 6, 30, 18, 11, 6, 7, 3, 6, 16, 8, 4, 1, 2, 5, 8, 4, 14, 5, 4, 8, 5, 8, 4, 16]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='2049\n', 0x5)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/ieee80211\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/phy0\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/phy1\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='+4.1 +4.2\n', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='4\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 test\n', 0x1f)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='test 1 \\x00000000 2147483647 /tmp\n', 0x23)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r5, &(0x7f00000003c0)='test /tmp 2147483647 9218 65534 65534 0\n', 0x29)
close(r5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,vers=4.2,clientaddr=127.0.0.1\x00'])
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='-2 -3 +4 +4.1 +4.2\n', 0x13)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000700)='1\n', 0x2)
close(r2)
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)
sendto$inet(r3, &(0x7f0000000a00)="80000070112233440000000000000002000186a30000000400000001000000000000000000000000000000000000000000000002000000010000004700"/116, 0x74, 0x0, 0x0, 0x0)
recvfrom$inet(r3, &(0x7f0000000b00)=""/256, 0x100, 0x0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='module libceph +p\n\x00', 0x12)
write(r0, &(0x7f0000000140)='file messenger.c +p\n\x00', 0x14)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/dynamic_debug/control\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='module libceph +p\n\x00', 0x12)
write(r1, &(0x7f0000000280)='file messenger.c +p\n\x00', 0x14)
r2 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000340)='source\x00', &(0x7f0000000380)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000003c0)='mount_timeout\x00', &(0x7f0000000400)='1\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='/dev/ram0,131072\x00', 0x11)
r1 = syz_open_dev$mtd(&(0x7f0000000100), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000140)={0x0, 0x400000})
executing program 3:
r0 = fsopen(&(0x7f0000000300)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='mon_addr\x00', &(0x7f0000000400)='127.0.0.1:6789\x00', 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000540)='-2 -3\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='tcp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x801, @loopback}, 0x10)
close(r2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0\n', 0x4)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/events_poll_msecs\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='10\n', 0x3)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='10\n', 0x3)
close(r2)
nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_grou', 0x10)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(r2, &(0x7f0000000300)='delete path_gr', 0xe)
close(r2)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r3, &(0x7f0000000200)='path_group G4 /bin/ls\n', 0x16)
write(r3, &(0x7f0000000300), 0x0)
close(r3)
nanosleep(0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='-2\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='-3\n', 0x3)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='-4\n', 0x3)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r3, &(0x7f0000000240)='tcp 2049\n', 0x9)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r4, &(0x7f00000002c0)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/firmware_class/parameters/path\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='.\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./usbduxfast_firmware.bin\x00', 0x42, 0x1b6)
close(r1)
r2 = syz_usb_connect(0x3, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81310000000000000010902290001010080320904000000ff0000000904000102ff0000000705860200020007050402000200"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
nanosleep(&(0x7f0000000280)={0x0, 0x1dcd6500}, 0x0)
r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000300)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_CMDTEST(r3, 0x8050640a, &(0x7f0000000400)={0x0, 0x0, 0x1, 0x1, 0x2, 0x0, 0x4, 0x7530, 0x20, 0x1, 0x40, 0x0, 0x0, 0x1, 0x0})
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd26, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x4)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, r2, 0x3e8}}, 0x48)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0xe)
clock_gettime(0x0, &(0x7f0000800000))
clock_gettime(0x0, &(0x7f0000801000))
clock_gettime(0x0, &(0x7f0000a00000))
clock_gettime(0x0, &(0x7f0000a01000))
madvise(&(0x7f0000800000/0x400000)=nil, 0x400000, 0x19)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='+ 1 0 1 1 0\n', 0xc)
write(r0, &(0x7f0000000280)='+ 1 0 2 1 0\n', 0xc)
write(r0, &(0x7f00000002c0)='+ 1 0 3 1 0\n', 0xc)
write(r0, &(0x7f0000000300)='+ 1 0 4 1 0\n', 0xc)
write(r0, &(0x7f0000000340)='+ 1 0 5 1 0\n', 0xc)
write(r0, &(0x7f0000000380)='+ 1 0 6 1 0\n', 0xc)
write(r0, &(0x7f00000003c0)='+ 1 0 7 1 0\n', 0xc)
write(r0, &(0x7f0000000400)='+ 1 0 8 1 0\n', 0xc)
write(r0, &(0x7f0000000480)='+ 0 0 2 1 0\n', 0xc)
write(r0, &(0x7f00000004c0)='+ 0 0 3 1 0\n', 0xc)
write(r0, &(0x7f0000000500)='+ 0 0 4 1 0', 0xb)
write(r0, &(0x7f0000000540)='+ 0 0 5 1 0\n', 0xc)
write(r0, &(0x7f0000000580)='+ 1 0 1 6', 0x9)
write(r0, &(0x7f0000000600)='+ 1 0 3 60 0\n', 0xd)
write(r0, &(0x7f0000000640)='+ 1 0 4 60 0\n', 0xd)
write(r0, &(0x7f0000000680)='+ 1 0 5 60 0', 0xc)
write(r0, &(0x7f00000006c0)='+ 1 0 6 60 0\n', 0xd)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000500)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='/dev/ram0,65536\x00', 0x10)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/23)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/ubi0\x00', 0x2, 0x0)
ioctl(r3, 0x40986f00, &(0x7f0000000d00)="000000000100000000001800000000000300040000000000766f6c3000"/134)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000f00)=@filename='ubi0_0\x00', &(0x7f0000000e00)='./mnt\x00', &(0x7f0000001000)='ubifs\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/firmware_class/parameters/path\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='.\x00', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='dvb-usb-vp702x-02.fw\x00', 0x42, 0x1ff)
close(r1)
syz_usb_connect(0x3, 0x32, &(0x7f0000000200)=ANY=[@ANYBLOB="12010002ff000040d31307320001010200010902200001010080fa0904000002ff0000000705020200020007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r2 = syz_open_dev$dvb_frontend(&(0x7f0000000400), 0x0, 0x2)
ioctl$FE_READ_BER(r2, 0x80046f46, &(0x7f0000000500))
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x3, 0x1b1c, 0x1c1b, 0x0, 0x0, "0600ff0901a1010902150026ff007508954081020903750895409102c0"}}, 0x131)
write(r0, &(0x7f0000000400)="0c000000000000004000fe0300"/76, 0x4a)
write(r0, &(0x7f0000000500)="0c0000000000000040000399434f525341495200"/75, 0x4a)
write(r0, &(0x7f0000000600)="0c000000000000004000039a48583535306900"/75, 0x4a)
nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0)
executing program 5:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x800, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x300, 0x7, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x10, 0x2710, 0x20, 0x1, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x1, 0x0})
ioctl$COMEDI_POLL(r0, 0x640f)
read(r0, &(0x7f0000000400)=""/100, 0x64)
ioctl$COMEDI_BUFINFO(r0, 0xc02c640e, &(0x7f0000000500))
ioctl$COMEDI_CANCEL(r0, 0x6407)
executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x0, 0x0, 0x10}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x0, 0x0, 0x4}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x0, 0x0, 0x32}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x0, 0x0, 0x32}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x0, [{0x1c, 0x0, 0x0, 0x0, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x0, [@NFTA_DATA_VALUE={0x8, 0x1, "01020304"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x0, 0x0, 0x32}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f")
write(r0, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00cache\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001:0 1:1 1:2 64 0 default 0\x00', 0x42)
ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000007a01000038010000010000000000000000000000000000000000000000000000000000006d79706f")
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24)
close(r2)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r3)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='ath9k\x00', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='pcspkr\x00', 0x7)
close(r1)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/r8a66597_udc\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000200)='bind\x00', 0x1, 0x0)
executing program 2:
syslog(0x3, &(0x7f0000000000)=""/1024, 0x400)
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/proc_name\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/proc_name\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host2/proc_name\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0)
readlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:05.0\x00', &(0x7f0000000000)=""/256, 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:06.0\x00', &(0x7f0000000000)=""/256, 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:07.0\x00', &(0x7f0000000000)=""/256, 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/devices/0000:00:08.0\x00', &(0x7f0000000000)=""/256, 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:09.0\x00', &(0x7f0000000000)=""/256, 0x100)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:0a.0\x00', &(0x7f0000000000)=""/256, 0x100)
executing program 5:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000040)={0x0, {}, 0x0, 0x4})
r1 = syz_open_dev$dvb_dvr(&(0x7f0000000100), 0x0, 0x1)
write(r1, &(0x7f0000000200)="474000100000b00d0001c100000001e020a2c380ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0xbc)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='udp 20000\n\x00', 0xa)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='1\n\x00', 0x2)
close(r1)
r2 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r2, &(0x7f0000000280)={0x2, 0x4e20, @loopback}, 0x10)
write(r2, &(0x7f0000000300)="000000010000000000000002000186a30000000400000001000000000000000000000000000000000000000000000000000000010000002300000001000000020000000474657374000000000000000374637000000000093132372e302e302e3100000000000000", 0x68)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x2, 0x0)
write(r3, &(0x7f0000000440)='0\n\x00', 0x2)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='2049\n', 0x5)
read(r0, &(0x7f0000000200), 0x100)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/drivers/virtio-pci\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000100)=""/4096, 0x1000)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:1f.2/config\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:1f.2/class\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:1f.2/enable\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:1f.2/reset\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:1f.2/remove\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:1f.2/rescan\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
readlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/drivers/maxtcpc/0-0022\x00', &(0x7f0000000400)=""/256, 0x100)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dbg/bluetooth/l2cap\x00', 0x0, 0x0)
read(r0, &(0x7f0000000700)=""/1024, 0x400)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24)
close(r2)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r3)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 6 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-close-syz_open_dev$mtd-ioctl$MEMERASE-close-openat$ubi_ctrl-ioctl-close-nanosleep-openat-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='/dev/ram0,65536\n', 0x10)
close(r0)
r1 = syz_open_dev$mtd(&(0x7f0000000800), 0x1, 0x2)
ioctl$MEMERASE(r1, 0x40084d02, &(0x7f0000000900)={0x0, 0x400000})
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0)
ioctl(r2, 0x40186f40, &(0x7f0000000b00)="ffffffff0100"/24)
close(r2)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r3)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-read
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dbg\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dbg/bluetooth/l2cap\x00', 0x0, 0x0)
read(r0, &(0x7f0000000700)=""/1024, 0x400)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write-nanosleep
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)

program crashed: WARNING in __netif_receive_skb_core
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program crashed: WARNING in __netif_receive_skb_core
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
syz_init_net_socket$llc(0x1a, 0x2, 0x0)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
ioctl(0xffffffffffffffff, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
syz_open_pts(r0, 0x2)
r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r1, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)=0x11)
r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r1, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000080))
r0 = syz_open_pts(0xffffffffffffffff, 0x2)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11)
r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r1, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(0xffffffffffffffff, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0)
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, 0x0)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, 0x0)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200))
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m24.187993374s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
simplifying C reproducer
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing compiled C program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
program crashed: WARNING in __netif_receive_skb_core
testing program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program crashed: WARNING in __netif_receive_skb_core
validation run: crashed=true
testing program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program crashed: WARNING in __netif_receive_skb_core
validation run: crashed=true
testing program (duration=1m24.187993374s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-ioctl$TIOCSPTLCK-syz_open_pts-ioctl$TIOCSETD-syz_init_net_socket$llc-ioctl-write
detailed listing:
executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000080))
r1 = syz_open_pts(r0, 0x2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11)
r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
ioctl(r2, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/40)
write(r0, &(0x7f0000000300)='e1a\r', 0x4)

program crashed: WARNING in __netif_receive_skb_core
validation run: crashed=true
reproducing took 1h7m31.538213056s
repro crashed as (corrupted=false):
------------[ cut here ]------------
1
WARNING: ./include/linux/skbuff.h:3003 at skb_reset_mac_len include/linux/skbuff.h:3003 [inline], CPU#1: kworker/u8:1/13
WARNING: ./include/linux/skbuff.h:3003 at __netif_receive_skb_core+0x294/0x30c0 net/core/dev.c:6061, CPU#1: kworker/u8:1/13
Modules linked in:
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:skb_reset_mac_len include/linux/skbuff.h:3003 [inline]
RIP: 0010:__netif_receive_skb_core+0x294/0x30c0 net/core/dev.c:6061
Code: f8 4d 8d b7 b8 00 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 87 2a 00 00 45 8b 36 41 29 de eb 0c e8 fd f1 12 f8 90 <0f> 0b 90 45 31 f6 48 8d 9c 24 e0 00 00 00 48 c7 84 24 b0 00 00 00
RSP: 0018:ffffc90000a18a00 EFLAGS: 00010246
RAX: ffffffff89b4de53 RBX: 000000000000ffff RCX: ffff88801debddc0
RDX: 8000000000000100 RSI: 0000000000000100 RDI: 000000000000ffff
RBP: ffffc90000a18c40 R08: 0000000000000100 R09: 1ffffffff20f47af
R10: dffffc0000000000 R11: fffffbfff20f47b0 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000040 R15: ffff888072116dc0
FS:  0000000000000000(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7053346000 CR3: 000000000eb48000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __netif_receive_skb_one_core net/core/dev.c:6262 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x727/0x18b0 net/core/dev.c:6728
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 netif_rx+0x89/0xa0 net/core/dev.c:5837
 slcan_bump_err drivers/net/can/slcan/slcan-core.c:448 [inline]
 slcan_bump drivers/net/can/slcan/slcan-core.c:463 [inline]
 slcan_unesc drivers/net/can/slcan/slcan-core.c:476 [inline]
 slcan_receive_buf+0x1c5f/0x2140 drivers/net/can/slcan/slcan-core.c:807
 tty_ldisc_receive_buf+0x119/0x160 drivers/tty/tty_buffer.c:398
 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:452 [inline]
 flush_to_ldisc+0x247/0x6c0 drivers/tty/tty_buffer.c:502
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
1
WARNING: ./include/linux/skbuff.h:3003 at skb_reset_mac_len include/linux/skbuff.h:3003 [inline], CPU#1: kworker/u8:1/13
WARNING: ./include/linux/skbuff.h:3003 at __netif_receive_skb_core+0x294/0x30c0 net/core/dev.c:6061, CPU#1: kworker/u8:1/13
Modules linked in:
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:skb_reset_mac_len include/linux/skbuff.h:3003 [inline]
RIP: 0010:__netif_receive_skb_core+0x294/0x30c0 net/core/dev.c:6061
Code: f8 4d 8d b7 b8 00 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 87 2a 00 00 45 8b 36 41 29 de eb 0c e8 fd f1 12 f8 90 <0f> 0b 90 45 31 f6 48 8d 9c 24 e0 00 00 00 48 c7 84 24 b0 00 00 00
RSP: 0018:ffffc90000a18a00 EFLAGS: 00010246
RAX: ffffffff89b4de53 RBX: 000000000000ffff RCX: ffff88801debddc0
RDX: 8000000000000100 RSI: 0000000000000100 RDI: 000000000000ffff
RBP: ffffc90000a18c40 R08: 0000000000000100 R09: 1ffffffff20f47af
R10: dffffc0000000000 R11: fffffbfff20f47b0 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000040 R15: ffff888072116dc0
FS:  0000000000000000(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7053346000 CR3: 000000000eb48000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __netif_receive_skb_one_core net/core/dev.c:6262 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x727/0x18b0 net/core/dev.c:6728
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 netif_rx+0x89/0xa0 net/core/dev.c:5837
 slcan_bump_err drivers/net/can/slcan/slcan-core.c:448 [inline]
 slcan_bump drivers/net/can/slcan/slcan-core.c:463 [inline]
 slcan_unesc drivers/net/can/slcan/slcan-core.c:476 [inline]
 slcan_receive_buf+0x1c5f/0x2140 drivers/net/can/slcan/slcan-core.c:807
 tty_ldisc_receive_buf+0x119/0x160 drivers/tty/tty_buffer.c:398
 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:452 [inline]
 flush_to_ldisc+0x247/0x6c0 drivers/tty/tty_buffer.c:502
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>